Transcript
Once again, good morning, everyone, and welcome to the next episode in the Lucky Universal ZTNA series.00:11This time the episode is called migration from Cisco Umbrella to secure access. But before we dive in into, you know, today's session, let me introduce to you our presenters for today. So we have Susana Delmar Aragon.00:20And myself Januardokenovater. We are all customer success specialists for security and we are excited to share our knowledge and experience with you today.00:39Alright, now in today's episode, we will be focusing on the migration tool that helps you transition smoothly from Cisco Umbrella to Cisco Secure Access. But in case you missed them, we already had a few more episodes in this series.00:54So let me tell you a little bit about them.01:12Okay, e.g., in the 1st episode of Unlocking universal ZTNA, we lay the foundation. We explore the zero trust principles. We demonstrated how Cisco ICE secures the workplace, how do Cisco Duo is used to protect your workforce through it.01:14Entity and if you go to cool things with the Cisco secure firewall, clientless ZTNA picture.01:34For episode two, we introduced Cisco Secure Access, Cisco's store product when it comes to SSE. So we dived into all of the features that it has. It laid like all the context for what we're going to be doing today.01:40But most importantly, we were able to design that session as a greenfield deployment so that you can follow along and have an idea of how to get started if George is getting started, of course, with the with the solution.01:58Now, in today's session, we are addressing those of you who are ready to take the next step. We'll be focusing specifically on customers looking to migrate 1st from Cisco Umbrella to Cisco secure access and more importantly, how to execute that migration effectively and efficiently.02:13But let's see. We want this session to be engaging. So I invite you to please ask questions throughout the session. You will find the Q and A panel if you go to the bottom right corner of the Webex and click on the three dots and click on the Q and A.02:33Our panelists will be monitoring and they will be answering all of your questions. Okay, this is today's agenda, and as you can see is packed with everything you need to know about this migration.02:53You know, what it is, why we need it, all of the licensing, how it looks like once you once you migrate the workflow step by step, what you have to do, how to get ready for it with the prerequisites. We have been doing this for quite some time, so we have identified some of those challenges. Today we want to share.03:10Them with you so that you can be prepared, right? For that.03:30Some of the limitations, we're gonna see a lot of demos. We tried these that these sessions are intense or rich in demos. And lastly, we will change a little bit of the gears and we will share some of the integrations that we can find with Cisco secure access.03:35And if there are still any remaining questions, we will jump into the Q and A, right? Now, without any further ado, let me pass the ball to. Thank you, thank you James. Thank you very much. Yes.03:53Share my screen. So my name Island Heldela Rosa and I I am a customer success specialist for secure access and today I'm going to talk to you about the migration overview.04:09You maybe an umbrella customer and you already decide to to move to to secure access and that's why you are here. But you also maybe an umbrella customer, but you don't know why migrate to secure access or I will try to answer.04:24That question for you today. So, Cisco Umbrella has evolved to Cisco secure access. Why? The threat landscape expand and now attacker are more sophisticated.04:41So because the attacker become more sophisticated, your security must also evolve. And that's why we are excited to talk about secure access because he's more than security for a hybrid world. Secure access being on umbrella strength.04:58While delivering new advanced capability designed for today evolving risk. So you see the statistic on this slide, 94 % of organization are concerned.05:17About and only 4 % feel they are ready to prevent or respond to a cyber attack. And on the right side of the presentation, you can see the the key challenge that our customers are facing today.05:32Inconsistent user experience private application often not supported for security solution, complex policy management because they use different kind of product for security, so they require multiple license, different hardware.05:52Sometimes those products are not integrated so we don't have like enough visibility, so that reduce the the security efficiency and also because we don't have that visibility the troubleshooting is inefficient with multiple dashboards multiple tool and that that is.06:11A problem for for the customer. And that is the the advantage of secure access. So to answer the question, why to migrate to secure access? To stay ahead of threat.06:31Fiber threats are constantly evolving. So secure access offered some mechanism to keep you one step ahead of attacker, right? Simplify experience and that's one of the thing that I really love about secure access.06:43Is how, how easy is to use to use the product to configure everything. We have a very nice dashboard alright? So securex bring together power powerful protection and a simplified management.07:00Right, to streamline your security operation and make it easier to protect user and data whatever they are. Now it's not that complicated to protect your cloud solution, your on premise solution, your roaming user, your remote user. Now we can do that easily with secure app.07:15Access and we because we are talking about the migration from Umbrella to secure access. Another reason why to migrate because it's fast and simple. You may think, oh, another migration, you know, a lot of maintenance window, a lot of work to do.07:35Actually, we make it easier for you with our automated immigration tool. You can complete the upgrade in our if you want to minimizing disruption to your, to your business, right? And.07:53It's a smooth transition, ok? When we use the immigration tool, you will have a dual view, you will have access to the umbrella dashboard and the secure access dashboard during the migration. So ensuring continuous protection every step of the way.08:09Right? So that is the reason to migrate to secure asset, but let me talk to you about some features that make make you, you know, to do the decision faster, right? Like e.g., protect more.08:29Let's talk about now about cloud PMP. So why migrate to secure access because even so you are an umbrella DNS customer or you are an umbrella customer and and you want to migrate to secure access?08:45You are going to get what you have right now, you know the umbrella that you trust, right? The DNS different, you will get that plus other feature like cloud DLP, right? You may have a situation.09:01A user or or a colleague have put some sensitive data into a cloud share, and you are worried about how that could potentially be compromised and the kind of cleanup you will have to do and the kind of costs associated.09:18With that, we can help you with DLP, right? We can protect or make sure that not sensitive information is shared to to the most common cloud application like right Google Drive, Box.09:35Microsoft 3605 and so on. But not only about DLP. Let's talk about malware protection, right? We can scan your cloud application right again box.09:53Google drive. And the most important part is that we are not only scanning the new file that you upload to to those applications. We can also do a restro retroactive scan. Let's say that when you do the configuration, when you configure protection.10:10In in secure access, the 1st step is to do a stamp of all the files that you have already there.10:30Looking for malware. So for me, this is a very good reason to move to secure access, but let's talk a little bit more. Now, we need visibility, you know, the 1st thing we need in security is visibility. We, because we cannot control what we cannot see.10:37So that's why we need to to understand the the shadow ID, but now in this specific case, a shadow AI, you know, it's it's a reality that AI is there. So our user, our user are using AI tool, you know.10:57To maybe to create some some email to.11:17You know, to do part of their job and and to, e.g., maybe you have some internal AI tool and and they are used in the tool and they may share right sensitive information with the AI tool. And the worst part is that some AI tool may not approve it.11:22By the IT department, right? That's what we call a shadow AI. So the IT team need that visibility. Okay, what are the the AI tool that the user are using? Is that a legitimate tool is a is a safe tool to use or probably you have your own internal AI and you want to allow access.11:42Only to that internet AI tool, right? Eh but 1st of all you need that visibility and we can get that with AI app discovery.12:02With AI access, that is part also of the secure access, right? Now, we talk about AI and visibility, but how can I protect, right? Not only the interaction with the user and AI, but also my internal AI tool.12:11And we can also do that with AI gathering, right? We can protect the interaction with the user and AI avoiding, e.g., sensitive information to to be shared with the AI tool and and also using the.12:31AI tool for malicious purpose, like e.g. asking question like how to make a bomb, right? Extreme extreme example but yeah we can protect that. We can avoid that prompt to go to the, to the AI, and not only the prompt, we can also monitor the response.12:47From the AI tool to avoid that to to go to the, to the user, ok? So and also the sensitive information, you know, it's easy to tell today, hey, write me this email with this information or I have this PDF and I want a summary of that.13:05That may have some sensitive information that you don't want to go to any AI tool. So we can protect that that information don't go to the AI, right? So this is another good reason to move to secure access, but what about.13:23End to end visibility. If you are a network engineer or a security engineer, you know how important it is troubleshooting, right? And for troubleshooting again, we need visibility. The 1st question that that we ask when there is a problem is where is the problem, right? So.13:39So our user is reporting, you know, bad performance or hey everything is slow, I can you know, I cannot work properly.13:59And you need to troubleshoot that and we can offer that. We it's part of the of the secure access, you know, the the experience with thousandeyes, so you as a IT engineer, you can get that information, that visibility, right? How is the connectivity between the the.14:08Employee in the, and the local.14:28Network, the Wi Fi, the internet connection, how is the connectivity to the internet? How how how is the connectivity to some collaboration application or to some application on the internet? How is the connectivity to secure access and we can get that visibility with experience inside with us and we are going to talk.14:31More about that in later in the presentation in the integration part, but I just want you to mention all the new features that we have available for you in secure access.14:51So another point is how easy is to manage the, the policy in secure access. Let's compare with umbrella, e.g., right? In umbrella, when we talk about policy, right? We can talk about DNS policy, could be a web policy or a firewall policy. So we have to.15:02The different policy depend on the enforcement that we want to do, right? But that is not the case anymore with secure access, we have.15:24One dashboard, one kind of of policy if you have ever had experience with the ASA or the FTD, you will find that this is very similar, right? How we used to do it in a, in a firewall, we can create a section rule with different options.15:33As a source, we can select, you know, user group, devices, network. I mean we it's it's very granular how we can create the the policy in secure access in an easy way. One that's what only you know one place where we have.15:54Or our policy configured and we can be very granular with, with that, right? So that's another advantage of secure access because you know when you have multiple security device, multiple dashboard, the management can be complicated. With secure access you have everything in one place.16:12And that is that is good for the IT department because doing that before was so complicated, but now it's easy thanks to secure access, right? Now, I hope that answer your question why to secure access? Let's talk about now the the.16:32Right? When you enable the migration tool, AKA upgrade manager, you need to enable that before, and later as we explain how to do that. But let's say that you enabled already the the upgrade manager, right? We have the step.16:53To complete the migration. It's very easy and straightforward four step, ok? Four step. The 1st one, complete all prerequisite in your umbrella dashboard. So we have this prerequisite, the 1st one, we need to enable, Cisco security cloud sign on for all.17:11User.17:31Okay, that means that the umbrella user, the admin user not to login to the umbrella dashboard, they need to use the Cisco security cloud sign on, right? Then they need to update the virtual appliance so you have better appliance in the in the environment and an AD connector you need to update that.17:32The latest version and also so you have mobile devices or or Chromebooks, you need to take that for the latest version. So see you are an umbrella DNS customer, that's it for the prerequisite, right? Now, see you are.17:52Seek umbrella customer and you have some integrated with umbrella. You need to update the configuration on the IDP to to allow also connection to secure access, right? So these are the the 1st step of the migration process. And then when we move.18:07To the step two, the step two is very is very important. This is the state where the policy and component on the policy are copied to secure access, ok? Now, why this is an important step? Because let's say e.g. that.18:26Your umbrella subscription is expiring in at the end of March, right? But you got the, the, the secure access, right? You got the secure access, you want to do the migration because we allow you to have the umbrella dashboard.18:46And secure access at the same time, it is important that the umbrella license is still active, right? So how that happened? We need to pass the step two of the migration tool. When we do that, then the umbrella license is renewed.19:05Allowing you to to keep the umbrella dashboard and also the secure access dashboard. So a step two is a very important step. You need to pass a step two to be able to extend the umbrella license expiration, right? After.19:24You complete the step two, I mean depend on how big or how, how many policies do you have in umbrella? It can take I mean it's a minute, right? Probably I will depends, right? But I have seen it in minute, we can go to secure access and we can see the policy or.19:41Ready there, right? Now a step three is the step where we start to moving the traffic from Umbrella to secure access and this, this is one thing that I really like about the immigration tool, how easy it is to migrate the devices and.19:58Network, the the mobile device, the Chromebook, the roaming computer to secure access, right? So.20:18As you can see in the picture when you start, you will get this this screen, right? Where you have the umbrella on the, on the left and secure asset on the right. And you just need to select the type of device, it is network, network device.20:26Roaming computer, the type of device, then you select the device that you want to move and you click the, the, the move button that is in the middle between the the umbrella panel and secure access panel. Is that easy to migrate the traffic from Umbrella to secure access? And you can see, you know, the percentage, how how many.20:44Any devices have you moved from umbrella to secure access. You can see also e.g. how many device or network or roaming computer are in secure access and how many device are in.21:04Umbrella, but let's say e.g. that you move a device and that device is not working properly or it's complaining a lot and you don't have time to troubleshoot. You can easily move back that device to umbrella, ok? That's also a possibility, right?21:17Now, when you complete the movement of the traffic, I mean this is 100 % and you test that everything is working fine in secure access, then you can move to step four, right? A Step four is to complete.21:34The the migration. In this stage, you are going to close umbrella, and now you are going to enjoy completely secure access in the new feature, right? So that's all for me for today. Thank you very much. Now, as Susana, we are going.21:50To talk to you about the licensing is another important information.22:10Thank you so much, good morning, everyone. I'm Susana. Happy to be here with you today. I'm gonna speak about important things to know about the migration, started with the licensing topic. So which umbrella licenses.22:22Apply for the migration tool. We have single organizations that are the standalone accounts and we have multi org organizations, ok? Let's start with the single organizations. Mostly all active umbrella packages.22:42Apply for the migration tool, including the legacy ones, insights, platform, professional. The ones that don't apply are premium and DNS monitoring, but these ones can be converted. So don't worry if you have one of these ones and you would like to migrate.23:02Okay, the insights and the platform, the legacy packages mapped to the DNS advantage and this one would be in secure access the DNS defense advantage.23:21And the professional would map to DNS essentials and this one would be in secure access, the DNS essentials. Something to take into consideration.23:37If you upgrade from a higher tire, for instance, umbrella insights, that would be DNS advantage, ok? You can see here the DNS advantage that eh, for instance, for this specific case.23:56They have included the intelligent proxy feature. You if you go from an advantage tier to an essential tier in a secure access, you lose this functionality.24:14This is something to take to take into consideration. And if you do this, please make sure to deactivate that feature in, in umbrella before.24:32Migrating to secure access using the migration tool because it could cause issues, ok? From the multi org accounts, the ones that are managed by partner and they have child organizations managed by.24:48The end customers. These ones can be migrated to, but they would need to open a tag case to the couple, the that channel organization from the partner. The, the parent organization managed by the part eh partner.25:08And the multi org organizations managed by end customers. These one are under development, ok? This will, the tool will be available in the near future, ok? It's is right now under development.25:27So right now we we it's recommended to to wait until the release of the tool that supports the migration for multi org organizations.25:43The migration workflow. So here we can see the eh, in this scheme three planes, ok? The admin plane, the umbrella plane, and the security cloud control plane. So.26:04Before we start, we need to make sure that the administrator that is going to perform the migration has the same email in Umbrella and the same email in the security cloud control.26:20Portal. Before starting the migration, this admin might not have a security cloud control. So if that is the case, don't worry. Okay, so let's start.26:36With the, with the 1st step that would be to review the prerequisites, then the when you purchase the secure access license, you will receive a welcome email with a code.26:52So hold your horses here, don't do anything yet because if not, you can create a brand new secure access organization and we don't want that. So if you are migrating from Umbrella to secure access.27:10The the 1st thing to do would be once you review the prerequisite limitations and and so on, you go to the umbrella dashboard and you click on request invitation and this can only be done once, so please make sure.27:27That you are the the administrator that will do the whole process. So once you request the, you click on the button to request invitation in the umbrella dashboard, you go to your email, you, that you receive from the security cloud control with the.27:45Steps to either sign in or to create a security cloud control. So if you already have one, you don't need to create a new one, of course. So be careful if you have one just sing into yours and and come and complete the steps.28:05Then you claim the subscription following the steps in the dashboard. You will see an invitation to attach existing product. This is very important, this step because it's the connection with the with umbrella.28:25So if the instance ID that you see in the security cloud control from the invitation that you see in the dashboard is the same as your umbrella organization ID, then it's all is good and you can proceed.28:42But if you don't see this, if it's not the same number, then you need to resolve this ID mismatch. This can be caused by several things. So depending on the case.28:59You may need to open a case with TAC, ok? So but let's imagine that you are doing the procedure correctly and the next step would be to attach the existing instance because you will see.29:16That you can create a new one and you don't want that. You want to attach it to the umbrella one. So you click on existing instance and then you, you apply the license, but apply applying the license here doesn't mean that you are going to.29:34This this step doesn't doesn't mean that you are going to have the umbrella license extended, ok? So this is very important.29:58You need to pay attention to your umbrella license expir expir expiration date. You can see that in the umbrella dashboard and the licenses, and that needs to be active for the whole duration of the migration, at least until completing the step two.30:09Of the migration process, ok? If you haven't if you haven't checked that, please check the 1st thing because it you may you it might expire and you won't be able to access to the umbrella dashboard.30:28So please make sure you have your umbrella license the expiration date is long enough to complete this procedure. Then you refresh the the page, the umbrella dashboard and you will be able.30:46So to see the upgrade manager.31:04So once you see that you can start with the migration tool. The steps are the ones or just explained and so the 1st one would be the prerequisite, 2nd one would be the migration of the policies, and once you complete the step two.31:07For the migration, the umbrella license will get automatically extended to the duration of your secure access.31:26License. So after this you can take as much time as you need to to do the testing in the steps in step three that is the the migration for the traffic that you can do one by one and then.31:35Once you are ready to complete the migration, the step four will close the umbrella, forever. And this would be the app so this would be for the workflow. Now let's talk about prerequisites.31:51The critical ones do not create security cloud control if you have already one. Do not activate the secure access license before starting with the migration process.32:11Umbrella and secure access licenses must remain active before and during the migration, and the instance ID in security cloud control must match the umbrella organization ID.32:31As I was mentioning earlier. Administrator requirements. Here we can see the umbrella dashboard with the request invitation button. So.32:47The invitation request can only be used once must be executed only by the migration owner and the same admin email must exist in Umbrella and the security cloud control.33:03Exactly the same email with the same domain and and in the case that you have the security cloud control or instance already created, how to prepare before the migration?33:19So in the security in this in the secure access, sorry, in the umbrella dashboard, do some clean up of your policies if eh because this one will be migrated to secure access.33:37The policies in umbrella, for instance, the DNS, the DNS policies in umbrella, will turn, will, will be translated into three policies in secure access. So the more the more policies you have in umbrella, the more you will have later in secure access.33:54So we recommend you to have only what you need. So this one will be the ones in secure access times three. Then resolve warnings and errors.34:14When you are with the migration, so during the migration process, we recommend to do to don't do any changes because this may break the the migration flow.34:33So you may do a change in umbrella, and this won't be migrated or could break something. So during the migration, if you need to do any change is better to do before or after once you have the secure access dashboard.34:51Update the virtual appliances, the connectors for active directory, the mobile clients, Chromebooks and the umbrella module or roaming module in the Cisco secure client. Now.35:10These considerations are only for migrations from Umbrella sick. Okay, this doesn't apply to umbrella DNS.35:28The policy order after the migration. So you know that in umbrella you have DNS policy separated from web policy and also separated from the firewall policy. In secure access, all of them are unified.35:46So how is the translation logic? 1st we'll, so on top of the rack would be the firewall policies, then the web policies and at the bottom will be the DNS policies.36:02With this said, if you have in your web policy allow Facebook, and then you have in your DNS policy block Facebook, the result in the end in secure access when you are testing the traffic in this in the.36:19In the step in three of the migration, you will see this is why it's very important to test before completing the migration. You will see that Facebook is allowed. Then knowing this based on this.36:37A plan your policies ahead. So if you would like to block Facebook, you know that you need to block Facebook also in the web policy. All right? Then SAML for end users.36:55You need to update your identity provider to include the secure access new metadata XML file. And this needs to be performed during a maintenance window. The Cisco secure client roaming module or the umbrella module.37:13The changes will apply once the client synchronizes the new configuration. The pack files, the, the pack files, the at the migration step three when this the traffic redirection.37:29You can copy the new pack URL from the secure access dashboard and you can update the end devices with it. And the network tunnels requires manual configuration.37:46But it will migrate the eh, the names of them so you in secure access so you can click once you, your secure access dashboard is generated, you can click on each network tunnel groups. It will launch a wizard where you can complete few steps like.38:02Generating the new passphrase and then you, you need to reconfigure manually your network devices with the new secure access information. These, the ones that you see the warning icon are to perform during a maintenance window.38:22The Common challenges and solutions. So, not able to log into Umbrella after purchasing secure access. This is because your umbrella license has expired.38:41So you, if it's urgent, eh, that most likely will be, please open a case with that urgently because you, you lost access to your umbrella dashboard and copy your account manager.38:59In that case because most likely they will need to extend it for longer, ok? Using the codes for license activation before starting the migration. This.39:16Can happen. Why? Because when you, you get the, you buy the secure access licenses, you will receive right away an email with the codes and the email tells you to perform some steps, but that email is not for the migration.39:31So for in the case of the migration, you need to hold and and not and not do anything with the codes and you do, you will apply the codes when once you start with the migration em.39:51From the umbrella dashboard when you click on the button to to request the, the, the invitation, ok? It well if you already done it, then there is a deactivation procedure to roll back.40:09So you can do that as well. That is, that is documented, it's simple to, it's easy to do. So don't worry if you already have done this because it has solution. Request invitation button not showing in umbrella.40:25This can be for license if that maybe the license that you have is one that doesn't apply for the tool. So don't worry, just open up that case with your account manager in copy in case they need to give you a license to perform the the migration.40:45And last but not least, after requesting the invitation in umbrella, cannot find the invitation to attach existing product and security cloud control. This most likely is because you either had another, you, you created another security control.41:06Instance or another administrator is doing this step, so it wasn't the same that click on the button, so, that's why it's very important to use the same email.41:23That clicked on the button to perform these these steps and also to use the same security cloud control instance. All right, this was all from my side.41:38Thank you so much. I hand it over to Hydrou. He is going to explain the limitations. Thank you very much, Susana a nice presentation. Now let's start with the part about limitations and for sure, welcome to this webinar, please ask a.41:53Anything that you need, we will ask answer any question that you have please don't worry, ask anything that you need, ok? So let me start with the part of limitations and well you will see how it looks.42:13From the part of limitation, let's start talking about the umbrella part. But before that remigration preparation is critical to avoid policy immigration issues and lots of configurations so take that in mind. Now, if we're starting checking in the part of policy immigrations for umbrella DNS, acts are not.42:27Supporting during the migration and at least one supported identity into the policy before you click the step two button. What happened? The tags are not supported in secure access and in umbrella you have that. There are some customers that only have tags in the policies, so at least to permit the migration from umbrella to secure.42:48Access when you have that limitation you need to put a valid identity. What is a valid identity? A roaming computer, a user, a group, at least to permit the migration of that policy to Cisco secure access. If the policy is not needed, well, you can let the tax and this policy will not get migrated to Cisco secure.43:08But take that in mind because sometimes customers migrate and there is only tax in the, in the in umbrella and the policies didn't get migrated to Cisco Cisco secure access.43:28Now policies cannot be deleted from the SSE dashboard while the immigration portal is active. When you have the dual view, you will see that in the videos. You will have a video where it explains how the dual view looks, right? So you will have access to Umbrella and you have access to Cisco Secure Access.43:40Then you will have enforcing eh enforcement points, ok?44:00So that means when you get migrated the policies to the other side in on secure access in the dual view, you cannot delete any policy. Policies with more than 250 identities do not migrate automatically. So if you have this type of policy.44:04Is with this amount of users or identities inside, eh.44:24Try to configure it in a way that is less than two a hundred 50 per policy, ok? So take that in mind before you make it. Now, access role and management. So taking into consideration that the way how we are handling right now the authentication.44:29For the cloud solution of Cisco, everything will be starting being managed by security cloud control. So there are some specific roles. So if you see right now we support full administrators, security administrator and read only in the security cloud control. We don't have the old roles that we have in umbrella. So the.44:49Keep that in mind.45:09If they joined the immigration with MSP admin accounts, what happened when you have a MSP account that you are using to log into an organization of a customer, maybe it's because the customer added you, but you are part of an MSP organization and you are part of the single sign on of the M.45:11You will have issues because it will tell you that you will have an issue moving the em.45:31The authentication way with the MSP to, the one with security cloud control, but it's only because you're using a user that is part of the MSP account. So in that case, you need to use a user of the customer to do the migration.45:39Okay? Now, list categories and feature limitations. Legacy categories get out of great to secure access if you are still using the legacy categories. Don't not decrypt list cannot be modified while the migration portal is active in umbrella.45:55Block page bypasscode are not supported in secure access. Legacy IP support is not available in secure access, so what happened? If you have legacy APIs, you need to migrate to the new API to be able to support the movement when you change your.46:14From Umbrella to secure access. If you don't change that before the immigration, you will have issues with the API calls.46:34Network devices are not fully supported. Today we are only supporting Meraki DNS to integrate with Cisco secure access, but integrations like firepower threat defense or Catalyst SD one are not supported and in case that you wanted to migrate that from the umbrella portal of a customer, you can do that. The only thing that you need to have in.46:42Is please do not make any change after it get migrated to secure access. If you're doing that, after you get migrated to secure access, you will have issues or problems with that network identities. So don't modify the network identities configuration when it get migrated to secure access.47:02Until we support a firepower threat defense and catalyst SD one integration for DNS.47:22License migration constraint. So as long as Susanne explained to you before, the license don't get applied when you apply the license in the security cloud control. The license get applied when you pass the step number two of the immigration tool.47:29Okay, so if you have a license of an umbrella organization that will expire, if you don't go until the point number two, your li the license will get expired and then you will load the access to the portal. Package downgrade. So to mitigate from any package using in.47:46Intelligent proxy to DNS defense essentials. Let's say that you wanted to migrate from DNS advantage to DNS essentials.48:06You will need to disable the intelligent proxy, ok? If you don't do that, you will have issues with the immigration and in the step two it will get broken and you will need to open a tag case. For any downgrade remote unsupported feature to avoid unexpected changes if we.48:18Sure contact that before proceeding. The thing is, there are some features if you're doing downgrade that you need to remove from the portal for umbrella before you press the button to continue with the.48:38A migration after the step two. So be sure to to check that before, ok? In the documentation you will see more information about that part. Now, let's go with the umbrella seek migration tool pay limitations. So let's start with the part about the tunnels.48:48Maximum of 50 tunnels are supported. If your customer have more than 50 tunnels or you have more than 50 tunnels, you need to eh, at least change from 50 tunnels to from the sorry. If you have more than 50 tunnels, you need to reduce the number in order to make available to migrate or you.49:07You will need to do a manual migration, that means that you need to have another portal of secure access and do the manual migration.49:26Okay? Are not supported in the immigration tool. It will be supported soon, but it's not yet supported, ok? When you migrate using a SIG immigration tool, please.49:33Do not remove the prefix of SSE of the tunnel when you have it migrated in secure from umbrella to secure access, you will see in the in the video how it looks but please do not remove that prefix because this identified the tunnel from umbrella to secure access.49:49And vice versa. So now moving to the pack file requirements, devices using the legacy umbrella pack file do not appear as identity in the immigration tool. So what happened? Remember that when we doing the immigration of the the pack files.50:08We are not talking about pack files, we are talking about we are talking about registered networks because you enable the part of pack files in the or in the registered networks or traffic that's coming behind the virtual appliance, correct? So the thing is.50:28You will migrate the identity of the network as an example, and then when you move that to secure access, the traffic that is being using with the pack file to be authenticated for SWG will be moved to secure access, but you need to take in con one thing. When you press the.50:46The the button to a step two, it will generate the portal of secure access and then what is called when the pack file must be updated before redirecting the traffic to ensure a successful immigration. So you press the step two button, you go to secure access, you copy the new pack file, and then you start copy that in your network. This pack file.51:06Can be used in Umbrella and Cisco secure access but the umbrella one cannot be used in secure access. So if you migrate identity that have the.51:26That that have the pack file without changes you will expect issues, ok? So please change the pack file before you continue. Now, let's go to the next part that is the migration eh demos, but for the moment eh, we will go.51:39How to talk about some specific areas about the the migration. E.g., the 1st part we will talk about how to apply the license correctly, how to claim the subscription correctly.51:58Right? And then after that we will going to see the process of the immigration for umbrella DNS defense and seek migration, ok? So let's go. Now let's start with the part about the climbing umbrella product and subscription.52:17So you will see here in the portal that we have active networks that register a network roaming client, active active appliance and tunnels. So you will see that the tunnels are connected at sending traffic to umbrella. And also we have users and groups in umbrella, right? Then we have.52:36Have the part about the policies, DNS policies, firewall policies, web policies, data loss prevention policies, right? So then after that, when you go into the licensing part, you will see the both of request invitation, but before you proceed, you need to be sure about this. So.52:56If you have an existing secure cloud control account, eh, you need to be sure that if you wanted to use the this organization in your security cloud control, the email admin email should be the same. No, not should be the same. Must be the same, ok? So.53:15Take care about that because when you register that you you will need to be super sure that you are attaching the correct product in the security cloud control organization that you desire. So must be the same.53:35Okay, check that before you proceed with the immigration with the actual created organization of security cloud control.53:55Okay? Then after you you are sure about that, we can continue with the normal flow when the customer doesn't have the security cloud control registered, so you click request invitation and when you click request invitation, you will receive an email. And this email is the important one because this is the one that.54:02You will utilize to eh attach the product of umbrella in security cloud controller.54:22Now, NO reply security@Cisco.com is the email that will send the eh attached product invitation, ok? And also from this email you will receive the license when you bought the license of secure access, so be sure you have this eh if you wanted to find the email.54:28In the in the in in in your Outlook inbox.54:48So perfect. Then you click in the sign in to secure a close sign on and you will sign up, ok? For the 1st time, well, you will create the user, when you will choose the country password and then you get federated with duo. You will see.54:55Welcome to duo, so you will authenticate and you will register your identity in the Cisco Duo database. Then you will have the multi factor enabled. Then you will create a new organization, right? So, be sure that you choose the correct region of deployment. This is.55:11For the future, when you claim other products, this is for the future when you wanted to have the storage of the data of the security cloud control in a specific region, ok? So take that in mind.55:30Now after that we going to the platform management in the security cloud control and we go into subscriptions and you will see the attached product. So this is the 1st step, the attached product of the umbrella organization, so be sure that the org ID.55:46That you are attached that attached here is exactly the same that you have in umbrella, ok? So you will see that the number is here 8369841. And then in this part after, after you validate the number.56:03You will need to claim the license. So again, the license, you need to go to the email and search for a do not do not reply email and you will find an invitation with the license.56:20We'll see, like this. And then you can take the line code to put that client code in the subscription claim code, ok? And you claim co claim the license of a secure access, right? Here important you don't will create a new instance attached to existing instance, that is the instance.56:37That you attached before of umbrella, ok? Then you climbing and.56:57There we are. Okay, now it will tell you there is an action required for the Cisco secure access. Okay, you click action recorded and you apply the subscription to the umbrella organization that you have registered now in security cloud control. But one thing to mention, the license is not applying here.57:02The license is applied in the step number two of the immigration tool.57:22Yeah, so in this way you can see the instance ID of your organization and that's it. So this is the claiming umbrella product and the subscription under the umbrella product that you attach to security cloud control.57:27Okay? Let's go for the other part. Umbrella migration tool, ok? So now this is the step after you claiming the subscription and you claiming the subscription under the organization of Umbrella in security cloud control. The.57:44And when you go to the part of licensing in the portal of umbrella and you refresh, you will be able that you will have a new menu run upgrade manager, ok? So this upgrade manager will help you.58:04Who started with the flow of the immigration. So from the start it will tell you the prerequisites. The 1st one is the enabled Cisco security cloud sign on because the way how you authenticated to umbrella will change totally with secure access because security cloud control will manage the authentication for every cloud product.58:17Of Cisco. So.58:37That's why you are getting forced to migrate eh, to security cloud control single sign on. Question, is there a way that I can use my IDP later on? Yes, you can integrate your IDP in the security cloud control to manage the access to security cloud control and all the clouds eh organization.58:39Stations.58:59Now, let me go back here in this part, after you put next eh and you have the part of the save and notified, you will need to read that because this will disable the users in Umbrella and will send the.59:00Limitation to all the admin users on umbrella to create or to log in using security cloud control, ok? So after that you will be able to log in or the other users will be able to log in to the.59:19Umbrella or to the secure access organization. Now, the recommendations for update virtual appliance and ID connector and update Chromebook and mobile devices virtual appliance recommended version three.seven.one and after you migrate, you need to change.59:36From the legacy authentication of the virtual appliance and move to the enhanced authentication. This is mandatory in May 30. If you don't do that em.59:56And until May 30 if you don't do that, you will lost eh, the virtual appliances and you will already will need to redeploy the virtual appliances. So take that in mind. Chromebook operation operating system version 121 hundred 22 or above. Cisco security eh.01:00:07For Chromebook clients and version two.one.one of above, ok?01:00:27I see a question before that say, what happened with the umbrella module? Don't worry, you can immigrate with the version that you have umbrella module, eh but is suggested that you do the immigration with at least the version five.one.X.01:00:33Okay, in that case to honor all the changes that we have in secure access but you don't will have any problem if you wanted to migrate with an older version, ok? Then after that you will need to upgrade. So then when you finalize the prerequisites, it starts the part about the start upgrade, and this start upgrade, this is the step.01:00:51Where the license get applied and this is the moment where the policies get migrated from Umbrella to Cisco secure access and when the dual view get born.01:01:11We'll see, it will take as much 2 min and after that you will see that you will have a dual view. And what what it what it means about dual view? Well, you have access in Umbrella and you have access in Cisco secure access. So if you click in Cisco secure access run, you have.01:01:21Your policy is migrated.01:01:41So you will see that we have a pair of three policies per policy in umbrella, ok, for the DNS. So take that in mind, this is how it would look. It should be exactly the same that what you have in Umbrella to Cisco Securex, ok?01:01:43Now, eh, after you have this you can start playing with the traffic, right? You can start playing eh with the redirection of traffic, ok? Because everything get moved already to here. So you will see the users here that you have in.01:02:04Umbrella, you will be able to see the DNS forwarders that you have here, right? You will see in the activity search the part of the point of enforcement, so.01:02:23This is the power tool that you will use to know if the traffic is being redirected correctly to Cisco secure access, ok? And so when you click in Cisco secure access at the 1st time you will not be able to see anything because in order to have your traffic here, you need to.01:02:35Redirect the traffic 1st, but this is the step three of the migration tool, ok? So if you click in Cisco umbrella, for sure you will have all the traffic here because it's in umbrella. But here in traffic, when you start this point you can start managing how you wanted to migrate. So.01:02:53I remember, I see a question that said, but I can control what I can move, I can control what I can put in secure access or in umbrella. Yes, you can. And the my major question, if I have a problem, what I can do, you can roll back. So you can move the identity that is in secure access again to Cisco umbrella. If you.01:03:13You have or you are facing any issue, ok?01:03:33So after that, this is how we moving objects or moving identities to securex, so redirect traffic and simple. Redirect. And then when you click in Cisco, your access, you will be able to see the traffic here. So there is the moment where you're starting checking.01:03:38If my traffic is working fine, everything is expected, so.01:03:58After you migrate the 100 % of identities that you have in DNA in umbrella DNS, you will be able to close the portal of umbrella. For sure, there is a thing. Be sure that everything is working as you expected.01:04:03Okay? And then after that you can complete the upgrade and close the portal of umbrella. And how it looks in this way, you click in the start, then I understand I wish to proceed and there is NO point of come back again to umbrella. So it will close the umbrella portal and you will start having access only.01:04:19Insecure access, ok?01:04:39Now, let's move to the part about the SIG migration tool. There is not too much difference about how it looks, how we need to do the migration, but the only point that will change is the prerequisite and the new identities because we will have new identities that are web.01:04:42Sorry eh the tunnels and, we will have the update SAML configuration.01:05:01Again, it's exactly the same thing. Nothing changed from umbrella to umbrella DNS to seek in the case of the prerequisites only the SAML configuration. It, e.g., you have configured the SAML to authenticate the users for the web traffic of.01:05:09Back files or tunnel traffic.01:05:29Okay, so it's exactly the same thing. You will see that is not nothing changed in this area. And then the prerequisites about the versions of the virtual appliance and Chromebooks on mobile devices is exactly the same thing as you have in umbrella DNS.01:05:31And as I told you, this update SAML configuration. So this update SAML configuration, you need to point the SAML configuration that you have in.01:05:53Umbrella to starting pointing to secure access. After you migrate that you can still use that point of the configuration in the both sides, in Umbrella and Cisco secure access and it's only changed the way how you authenticate the traffic, ok? So after you complete that.01:06:04You will click next and we will proceed with the migration of the policies, ok? So here you are in the start point of the migration where you will see how the policies will get migrated from Umbrella to Cisco secure access, ok? So.01:06:22After you start in this point, eh, you will see that it will explain you about the immigration, how it looks, how it will show in your site, right? In secure access when you have the dual view. So you click next.01:06:38And you will see how the policies will get migrated from Umbrella to Cisco Secure access, ok? Now, after you start the point of the immigration, you will just start to see that the order is different here. Remember, secure access is like a firewall, right? So the policies are evaluated from the top to the bottom.01:06:53Now let's see how the policies looks in secure access when we're doing the migration tool, ok? Go a little ok now when we check in the policies, you will see that in the 1st position we will have the firewall policies.01:07:14Right? In second position, we will have the web policies. And in the last position, we will have the DNS policies, ok? So take that in mind because this is how we migrating to have exactly the same ordering that we have in umbrella.01:07:33Again, I know it's a lot of policies here, so after you close the portal of umbrella, and you have the secure access portal, you can start redefining the policies in a better way, right? So because here we have a lot of policies but in when we get integrated we can do.01:07:50Taking in consideration the logic of secure access in a better way. Now, after that, we starting the point of the redirection of traffic. In the point of the redirection of traffic, you need to be sure about the network to the group identities because yes, it gets migrated to Cisco secure access.01:08:09Right? But there is a requirement for the network tunnel groups. You will see that later. Again, it's the same part to migrate the traffic or directing traffic, nothing change is exactly the same thing, but for the tunnel groups.01:08:28Eh, well, you need to redeploy the tunnel literally, ok? You will see. So when we go into the part of connect and we're going to the end users and internet security, you will be able to see the pack file. This is the new pack file that you need to migrate from all the computers that you have in your.01:08:44Company that are using the umbrella pack file.01:09:04Who start using this pack file. If you don't do that and when you migrate or edit the traffic from umbrella to secure access, this user that have pack file will lost the access to secure access and well will we lose the the proxy identity and we lost the internet access. So please migrate.01:09:07Updates to the new backfile that work in umbrella and don't have any issue. Now, you will be able to see that here in the interest and security, we have the deployment option, deployment management traffic steering for the internal domains and then the back off options, ok? So here.01:09:27Everything about that area that you have in Umbrella will be here. Now, the certificate, the certificate will be exactly the same that you have in umbrella. The umbrella route certificate, ok? So it will continuously the certificate that you have in umbrella.01:09:46Then in network connections, when we go into the network tunnel groups, ah, it will tell you you need to migrate the network tunnel groups and then to migrate the network tunnel groups, you need to make changes. Ah, ok, which type of changes I need to do? And as I mentioned before, you see SSE BR one SSE HQ.01:10:01Please do not remove the prefix of SSE because this is the way to identify what is the identity from umbrella.01:10:22To secure access, ok? That you will migrate from the tunnels. Then the process of the migration for the tunnel groups will be simple, it's like reconfigure the tunnel, ok? So here we will point the tunnel group name, the region, there is new things here. So.01:10:29With umbrella, as I remember we have 250 mb of throughput. With secure access by each tunnel you have 1 gb, ok? Take that into consideration. Now, before that, why this is by default in that option? Because in umbrella, the.01:10:49Traffic to internet have enabled by default the nat option two, ok? So this is how we get migrated from Umbrella to secure access, ok? So you click update you are updating the part of the tunnel configuration, and then in this point is where you need to start reconfiguring the tunnel. So you will.01:11:09Start using this and starting configuring your device and FTD, and Fortinet Palo Alto, the device that you have connected to secure access, ok?01:11:29Then after that when you configure it properly, when you have the traffic addressing now to Cisco secure access, eh, when you configure again the tunnel, you will be able to see the next thing.01:11:41Here you will see that the tunnel now is doesn't need any change because you already make the change to configure it, right? And then when you're doing the migration from the tunnel of umbrella to secure access, this is not automatically, so you need to reconfigure the tunnels.01:11:59After you can configure the tunnels, you will see that the tunnel in umbrella get down as inactive, and then when you go to Cisco secure access it will be active. Again, here we have a new thing. In umbrella, we're using a single tunnel. In secure access we have.01:12:17So you need to deploy primary tunnel and secondary tunnel. Because when we're doing maintains in secure access eh, one of the tunnels get down in these maintained periods and the other tunnel will take care about the traffic, ok? So it is automatically when you configure that in the firewall for sure.01:12:38Now, after that, this is the more complex part of the migration with tools. And then when you go to activity search again, point on performance Cisco secure access, if you have the traffic here, ok, that's fine. You you you get migrated, right? And now.01:12:56You reach the 100 % of the traffic, you click next and send me history as the DNS defense. You will proceed to close and there is NO point to go back after you close the portal of umbrella.01:13:13Okay, so then you close the portal of umbrella and you will ask only have access via secure access. And that's it about the demos on how we should migrate. Now, I know there are questions related to the migration tool for multi tenant.01:13:30So, the news for that is umbrella multi immigration tool will be available in May, ok? So, eh, if you need an origin immigration or something like that, eh, please ping your account manager and tell the account manager to connect a.01:13:47With internal people to see what we can do, ok? So for now we will going to go to.01:14:07A little break to take a coffee, to take some snack. So we'll be in come back in 10 min with Jan Rosco that will present the part about integrations. Thank you very much. Thank you Hidera.01:14:15You're gonna do 5 min because of the time constraints. So thank you. See you in 5 min. Welcome back and I hope that you had a chance to, you know, refill your coffee, stretch your legs, hydrate.01:14:31Cause now we're gonna switch gears. We're going into integrations. Integrations, you know, they're, they're quite interesting because they, they add value, they expand the capabilities of Cisco secure access and take it to the next step.01:14:46So now let's check some of those out starting with Cisco secure client, a very important component of secure access, but now I wanna talk about client managed. I know this one may not be new.01:15:02But I guarantee you that it is very useful. You know, when you're deploying your Cisco secure client with along with all their modules, their configuration files, you're probably using a configuration manager, something like SCCM and ECM, right?01:15:20And whenever you need to update it, you need to redeploy. Same way. Well, not anymore. Client management is a functionality embedded into XDR and well if you don't have XDR, you also get access to it. It's just a different portal dedicated portal for client management portal.01:15:38Now, these will allow us to create deployments. That's what we call them. It's like a profile that contains the configuration for what modules enable, what modules do we enable, and with what specific configuration files, what specific software version, and so on.01:15:57Right? Now the cool thing about this is that by creating different deployment profiles, you can control what software version.01:16:17Gets deployed and to whom, ok? E.g., a different software version of your, your secure client can go to production, a different version for the IT team or also different modules.01:16:26Or a different, completely different version for your beta testers, right? So each would generate a different installer that you can later roll out with your configure manager. So that's something very cool. I will show you now in a demo, just also keep in mind.01:16:41It also allows us to have a capability for inventory, ok? Oss, host names, information about the devices, thanks to, you know, this functionality and you will see it in in this board. Let me show you how that looks like.01:17:00Okay. Now, this is XDR, right? Once again, keep in mind if you don't have access to XDR, you will also get access to this portal and just will not have the XDR Cool stuff. Now, by navigating on XDR to client management and deployments.01:17:17You will be taken here. Okay, now over here you will have the deployments that I'm telling you about, right? As you can see there are some default ones that they come based on, you know, Windows, the architecture, Mac OS, and so on. But the custom deployments, you can add different ones, as he mentioned, one for IT.01:17:3818 one for production, and here you choose the operating system, the architecture, right? So this is important. We, we need to create generate an installer, and then just follow the wizard, give it a name to the deployment to this profile, and then e.g. over here.01:17:57As you click next, you will be prompted to choose what you want to enable. In this case we were talking about cloud management. This is a module that is in charge for the cloud driven profile and software updates. This is what enables us to remotely tell an endpoint, hey.01:18:17We need you to update to this other version, ok? So over here, you will just come here. This this one must be enabled and some of the cool things that we're adding is that these labels that you see over here, right? So you can choose the version, but you can also choose a label like recommended latest.01:18:36And they will be bound to a dynamic version, something that the next recommended version will be updated and your endpoints will know about it. Moving forward you can see e.g. choosing secure endpoint choosing specific version if you want to have a bit more control over it.01:18:55Endpoint data loss prevention, this is primarily for if you this is something that you would like to to use on secure access. This is the way that you will come and deploy this component as well.01:19:13E.g., clicking on next, then you have secure client. We have to, e.g. enable here and say that we want to, you know, secure client, what's the version that we want, what's the VPN profiles that we want, and whatever other module you would like to install.01:19:27You just need to click on it. Diagnostic, umbrella posture, et cetera, right? It will ask you to choose the profile, etc. Now, this one, let me tell you, pretty cool, very useful.01:19:45You can massively deploy the secure access root certificate, right? Now this thing that we need for, it's going to be needed for the decryption in order for us to apply the policies. This is how you can massively deploy that certificate to all of your endpoints.01:20:00Zero trust access and so on. I'm gonna click next thousand eyes as well, which is one of the integrations that we want to talk about today. And after that, you get access to two installers. It can be either a full installer or it can be a network installer. Full installer, there's a bigger file with all of.01:20:20The modules and network installer just deploys the base, just the secure client, and once it's installed, it will connect to the cloud, identify what are the modules that were enabled for this deployment.01:20:40And download them. So depends on whether you want to save some bandwidth when deploying this. So here you go. That's one of the things that we have and that you can, one of the integrations, right?01:20:56Very cool. Now, the next one up, it's Cisco identity intelligence. Now, before we see how it integrates with Cisco Secure Access, let's understand a little bit of what it is. What is Cisco identity intelligence? Now.01:21:12We have seen, you know, customers may have many data sources that may have their identity infrastructure. It could be, you know, different tools, maybe it was an acquisition or you, you guys were acquired by another company and then you have different identity provider.01:21:29Writers, but you're lacking a unified view for all of your users contractors, service accounts.01:21:48And everything that they do, right? Because they're in different IDPs, there is not a unified view. This creates a challenge for those, you know, in the identity security posture management and identity threat detection.01:21:55And response space. Why challenges we may we face, you know, and perhaps the same user is created in two different IDPs. One is logging in, in one geographical location. 2nd one is the same user.01:22:10Different IDP but is located logging in in a different location, right? Unrealistic travel, that's how we call that. And then like because they're independent, they do not have visibility into this odd behavior, but by unifying that and sending all of that information into Cisco identity intelligen.01:22:25Now we can do something about it. Okay, so CII, it's an agentless solution. You don't have to deploy an agent for these, you just configure it and integrate it so that it can communicate with your IDP. And with all of that information, we can power duo.01:22:45XDR and secure access. Some of the use cases that we have for it are like creating a user inventory, monitoring all of those known employee accounts MFA adoption, right? Confirm which of those users have properly deployed MFA.01:23:05Which ones are using the right method, that kind of thing? It has, you know, capabilities for user or session investigation and continuous threat detection, thanks to some checks that we perform. E.g..01:23:24Part of CII is introducing this concept of a trust score. Now as you can see here, this is a screenshot from identity intelligence, and we're looking at a profile, at a user. And we can see that it received this untrusted score.01:23:40Now, why did it receive it? Based on a few checks that we performed, like, hey, this is a resurrected account, right? We see that it has received like a flawed of MFA requests, like those kind of behaviors. So we.01:23:57They're looking at them holistically and that way we can determine a score, right? Like this looks suspicious, and then it's assigned to the users, to the identity itself. Now let me show you how it all integrates with secure access.01:24:17In this little demo over here. So e.g., we are starting in secure access, ok? We're going to navigate to users and over here we see in our lab environment, we have three users.01:24:36Something that I want you to to direct your attention to is this new column, right, that we have over here. So there is a column for a trust level and you will see that all of them are trusted. And on the right side, we can see once we click on a user, we click on hit Clark.01:24:52We can get more information about it, right? So it's trust level, when was it the last time that it was changed? The last time that it was changed, and if it's failing any of those checks that we are performing, right? Now, what are those trust levels?01:25:09So, Cisco identity intelligence weighs several factors. Remember that we are feeding from our different IDPs or different identity sources, all of that information, events, identities, and so on to Cisco identity intelligence.01:25:28Then it will factor all of that together using a proprietary algorithm to produce a trust level score, right? It goes from trusted to untrusted and by the descriptions you can see that it's, it looks pretty fine, it looks good versus something like untrusted. Hey, hey, it's the behaviors.01:25:46That are exceptionally bad, malicious or undeservable. So there you go. That's what they are. That's how we're getting that information. And then let's see. Let's check the access policy, how to configure this. So by navigating to the rule defaults.01:26:06And global settings under your access policies, you will now see this option. This option right here which is called zero trust access user based access. And it's just a toggle button. User trust profile. So by enabling that.01:26:23You are instructing secure access to use this profile. Now what the profile says is like the configuration of what to do depending on those trust levels. For instance, we have trusted.01:26:40It's gonna be allowed. We have favorable. We are going to ask this user to reauthenticate every seven days and so on, right? Neutral, questionable every 24 h. Untrusted.01:26:55Right out, we're gonna block block it, ok? So there you go. So there is a profile, trust levels actions based on those trust levels, ok? So we are adding a different layer of security here with identity intelligence.01:27:11Now, how does it look like by going to the activity search, clicking on this user, we can see event details. We can see that the action was allowed, like this client based connection for this user was allowed, ok?01:27:27Now, let's see what happens with the, when the same user, as you can see now, it's untrusted, ok?01:27:43We're gonna do activity search once again, and once you click on the event, you're going to have the reason. So the action was blocked and the block reason, as you can see here is that the trust profile resulted in untrusted.01:28:01That's why, that's why we're blocking it based on that profile that we, that we created before. Okay, so if we find this scenario, let's see what else we can do. It could be an option, right? We can click on on the user, get more information. Like why did it get?01:28:18These untrusted level, right? And you will get more information about it. Risk from IDP reported account, sensitive app and denied country denied country, so there are like different things, different rules taken into account here.01:28:38And, e.g., additional context, shared authenticator and an MFA device recently registered, right? So you can see undesired behaviors over here we have the checks, all of those rules that we are performing to compile event.01:28:54And factoring so that we can get all of this score and so on. Now it could very well be that this is, I don't know, a legitimate user that is traveling, lost their phone, conducted IT, please give me my bypasscodes and register this new MFA device.01:29:13It's a legitimate use case, right? Sounds like bad luck, but a lot of things here. Now for in those cases, we have a bypass untrusted level. So you have the option to temporarily grant access to whatever private application this user is trying to use to get.01:29:33Even if they have this undrafted lab, ok? And you can select the duration maximum seven days, you understand that you wish to proceed. So let's check that out.01:29:54Okay, now this is an example logging in. I don't know if you Maybe it was too fast, but it is asking the user to re authenticate, ok? It's trying to access a private application, reauthenticates, login MFA, this is my device.01:30:11And now we get access. Now let's check how it looks like in the activity search. So we can click on the latest event and we can see that it was allowed, right? But if we check the event right before that one.01:30:31We can see that it was allowed only after it was blocked and asked to re authenticate, right? Once again remember that this is this untrusted level for which we created a bypass, a temporary.01:30:47Temporary bypass of this untrusted level. We can come back here and if you go to the trust level, you will see that there is like a countdown, you know, for how long more this bypass is in place. And you can also cancel it on the spot.01:31:04So there you go, Cisco identity intelligence, new, you know, I'm adding another layer of security, having in mind all of that, all of the identity information that we get from your different IDPs or sources.01:31:19Alright, now next, next integration, experience insights. These are powered by thousand eyes. Okay, now this next integration, I know it's it looks like a bit crowded. This is like, just stay with me.01:31:36This next integration addresses the challenge that every IT team faces eventually, and that is visibility into the user experience, ok? Now yes, we are using secure access, we are protecting our users, but now we also have the ability.01:31:51To, to know whether the connection is any good. If a user reports, hey, I'm unable to access an application, it could very well be because there is a security and access policy, a security rule that it's blocking the connection.01:32:09Or it could also be just a network problem, right? Now with experience insights which is powered by thousand eyes, we can answer those questions, ok? What will it give you? You can get.01:32:26Actionable insights into the endpoint that it's network, it's application performance, also end to end visibility. Now this is pretty cool because you can see from one end, the endpoint to the other end, the application private application or whatever it is that it's trying to reach and.01:32:41Everything in between how the network performance. It will speed up issue resolution because now we have more data that it's being dynamically and actively being collected and being measured when it comes to the network.01:33:01What data would that be? E.g., we can get information about endpoint performance like CPU memory or Wi-Fi signal, network performance, important network metrics, latency, jitter, packet loss, so on.01:33:21There are a few more things, right? Like top 20 SaaS applications, we're monitoring those for you from different regions so that you can get more information about it. And this table over here is just to tell you a little bit about the licensing. You by having secure access, you already get access to.01:33:37To thousand eyes to these embedded licenses, ok? And these are, you know, data retention, just for daying, the concurrency of tasks that you can run with the embedded licenses, but if you find that, you know, this is something that you.01:33:57Maybe interested in that maybe your help desk team, right? Receiving all of those level one initial tickets. Hey, I'm unable to access this application. Maybe this can help them to expedite their troubleshooting and you can perhaps expand the licensing if that's something you would be interested in.01:34:15Let me show you how it looks like. So here you have the experience insights dashboard on secure access. You will find it over here. You can see the bond for experience insights. The integration you have to complete integration 1st is very simple, it's just a wizard. Click on integrating.01:34:35Login with your thousand eyes credentials.01:34:55And then, click on next follow the wizard and it will ask you, do you want to monitor a specific target like your VPN heading, right? Like that kind of thing. Do you want to monitor your collabora collaboration application like Webex, Microsoft Teams, Zoom?01:34:58Etc. And then you will get the dashboard. Now this is the dashboard and let's quickly go through it. 1st we start up with the SaaS application widget, so it's top 20 SaaS applications, most used as you can see, AWS, Azure, and we can get the different.01:35:16Regions that we are monitoring that from. So if you don't know much about thousandeyes, let me tell you a quick, quickly about it. Essentially thousandeyes has something called cloud agents and they are deployed all over the world and we use them to test to send.01:35:36Synthetic network data to check the performance of applications, right? So we're doing that and giving you that information to you available here. That would answer some of some questions like, is there a problem in a specific region or something like that?01:35:55That your users are reporting. Yes, I can confirm that it's there, ok? Alright, let's see. Next widget is for the endpoint summary, so this is a lab environment, so we only have two endpoints that but this is where you will get them. And you also see the health status and what I like most about this is.01:36:12This map visualization here because it allows you to choose the health.01:36:32A status per region, so you can filter them by say unhealthy, and then that will tell you geographically where those endpoints are located and that will answer questions like, hey, is this problem, you know, global?01:36:38Is it just on a specific region, just a specific country, those kind of things. And keep in mind that these healthy at risk, unhealthy statuses are regarding the network. We will see that in a minute.01:36:54Okay, next one is the endpoint list.01:37:14And here you can search for your devices, you can search for a specific location, but it will be the full list of all of the endpoints that you have deployed, that you have deployed a thousand eyes module on, ok? And you will get information about the devices, healthy status.01:37:20E.g., right now you can see the definition of healthy and they're using different network metrics, jitter under 30 milliseconds packet loss under 10 %, average latency under a hundred milliseconds. And e.g., on healthy.01:37:37Latency over a hundred and 50 milliseconds and so on. So we are using factoring different network metrics to determine what's the network health status of the endpoint, and then you get more information about it, right? Like in this table latency.01:37:55Response time CPU depending on what's being monitored, ok? We can click in one of these devices and get more information about. We can get summary details, you know, who is logged in.01:38:12Device details, what version, what OS does it have certificate? Then we have the security part. This is what I was telling you about before, right? So it could potentially be that we are unable to access something because of rule is blocking it. So you can see what rules are are.01:38:28Created and affecting a specific device.01:38:48And then under right you have the blocked events and allowed events widgets and they will tell us if they're being blocked, right? So it's not network related but rather security related. You can click on view all and that will take you to the activity search, so you can dive deeper into what's going on.01:38:51Then we have the security event details. These are more about posture, like is it joined to a specific domain? Is it running any firewall disk encryption? What's the EDR solution that it has? And lastly performance.01:39:12Now this is based on specific tests or target that we are monitoring, right? You can choose the time range, the date and time from which you want to observe the performance because this is.01:39:28Actively being monitored, right? So you will have historical data to understand a baseline to know when something is wrong. Here we want to see something like a flat line, ideally on a, on a hundred percent, right? Or as close as possible, but we can see the drops.01:39:44Right, so indicating there was a problem. So it's color coded, green for good, right for bad, and we can see the performance, right? And once we're clicking along the side of the on this timeline, this lower widget called segment visualization updates to ref.01:39:59Liked.01:40:19What, what was going on going on at that point in time? Now, this one is organized in segments to answer the question, where is the problem? If we know that there is unable, you know, if there's a problem accessing an application, getting to a target, it is low, it is simply unresponsib.01:40:20We want to know if that problem is located on the agent side, like the computer or local network, maybe it's the connection, maybe it's the default gateway, the VPN head end, internet itself, maybe the ISP or the target application.01:40:40Okay, and then once you click on each of those segments, you get metrics, right? Like this one over here agent scores CPU memory, you get, oh maybe you know the CPU and memory were running high affecting everything else.01:40:57Connection with this is Wi Fi signal, maybe it's too weak for the gateway. Now gateway and VPN are automatically detected and then automatically monitor to identify the thousand eyes module will identify what is the local gateway, what is the VPN head end.01:41:13And it will start sending network probes to measure something like packet loss to the VPN head. What's the latency to the VPN head and things like that. Also to the local gateway. So you, as you can see, they will help you to isolate the issue.01:41:32VPN, there are a few of those that are supported, Cisco anyconnect is one of those, but there are a few other vendors also supported. And for the target in this particular case, we are monitoring the VPN head end of, you know, remote access VPN for secure access, so we're monitoring that.01:41:50There you go. So you can see cool stuff about troubleshooting, giving you more visibility. The next tab will give you access to these top 20 SaaS applications, as you can see which those applications are, the different metrics that we are collecting for them, and if you click on any of them and you choose the.01:42:07The time, e.g., you will get historical data. And here we can see that we're close to zero, but then on this particular point in time there was a peak, right? Now it could be a problem. It was not sustained over time, so maybe it was not.01:42:28A major problem. On endpoint test tab, you will have the licensing usage. Remember you have some embedded license that come with your secure access, but you can also expand these by purchasing additional accesses to create more tests. Now, what are those tests? You can think of tests as.01:42:44Targets. When, when we create a test in the context of thousand eyes, what we do is to define the application that we want to monitor.01:43:04Okay, so you go, these are the applications the default endpoint is that we're monitoring, as you mentioned VPN heading and Webex collaboration app and.01:43:19Lastly, AI insights. So it's three widgets, one for devices, one for region, one for the low performing applications, and you will have an AI assistant with some predefined prompts that will allow you to investigate, collect more data about what's going on on those specific.01:43:33Categories. So you go. Now, oh, but there is more, right? Many of our customers don't know that by getting secure access they will get these embedded licenses to thousand eyes.01:43:52Which will allow them to access the thousandeyes platform, which means that they will get access to the flexible dashboards and alerts of thousandeyes. So there is a quick demo on thousandeyes. So let me introduce to you. This is thousandeyes platform.01:44:10And what I want to show you here is that we can create dashboards, ok? Now the dashboards will be comprised of widgets. A widget is this that you see over here, right? These that you see over here. And essentially you can graph.01:44:30Any metric being collected by thousandeyes, memory, CPU usage, latency packet loss, Wi Fi, you can graph any of that over time, ok?01:44:47We can use different types of widgets so that you can display your data depending on what's more relevant, and there are different things. Let me show you a little bit. E.g., if we analyze this one over here, this widget, we are looking at the.01:45:02Gateway latency, so that's local gateway, right? And what we want to see, we're talking about local gateway, your default gateway for your computer. So what we want to see is on this axis, X axis we have time over here we have.01:45:21Latency, right? So what we can see here is we want to see under one millisecond, you're talking about default gateway and we can see like a strong concentration of that over here, but there are a few of those scenarios in which we went.01:45:42Very high. Thankfully, this was not sustained over time. So maybe it was just that the user was moving from one place to the other. But, but this is it, right? You can get some idea, some of these gridgets will answer some of the questions.01:45:59Where the problem is, wasn't sustained over time, et cetera, ok? There are different types of widgets and different measurements like e.g. using the 90th percentile. This one is very useful when it comes to identifying those outliers. You maybe measuring.01:46:17E.g., the latency of a network, and it looks pretty good, but maybe because there are like many of them performing really good, but just a few of them performing really bad and it's skewing the the metric. So by using press the 90th percentile.01:46:36You can just concentrate on those ten top 10 % of devices or hosts that are underperforming, right? So you can, e.g., let me change in this case, I'm going to check the view instead of like all of them together.01:46:55I can split them per device. These are the devices each of them getting a different color, and then it's clear that the green one, which is mantile, has a better performance that e.g. the orange one.01:47:11As, right? So there you go, lot of troubleshooting, you will get different widgets like these ones where you can graph over a period of time. Hey, this is the number color coded green for good, red for bad, notifying me.01:47:27And so on. So from here on is, is all about the creativity is about what you need. Creating a dashboard that suits your needs and tells the story. Okay, so I'm going to.01:47:42Skip ahead. Just a couple more more Stay with me. Cisco eyes for Cisco eye, what we're doing is that we are remember all of these sgts that you are, you have been using for a long time with your identity service engine, right? We can.01:47:59After we integrate ICE with secure access you can use those SGT identities and create policies for that, right? So we will have this rich context of what they use, who the user is, what the device that they're on, what's the posture.01:48:16The role, all of that thanks to the SGT and you can create policies based on it. For a catalyst SD one, we have the ability now to create automated tunnels.01:48:32So essentially Catalyst as the manager is going to leverage the API of Cisco secure access. It's going to retrieve information, ok, like your key, IP address of the primary data center, IP address of the secondary data center, and then.01:48:47Using a post request of the API will create that tunnel after just filling out a few of those details on the SD WAN side. We have internet access support for tunnels for internet access support, introducing these versions over here.01:49:05Twenty.fifteen.one for SD one manager and for the iOS XE seventeen.fifteen.one. And later we introduce the same for private access. This way would look like in the SD one.01:49:22Manager, so by navigating to the secure internet gateway SSC, you have the option to add secure internet access, tunnel or add a private application access tunnel, right? And.01:49:39Those are just the, the flows that we're gonna follow, ok? For cisco Meraki, e.g., we have pretty much the same thing. Also, automated tunnels, this is just how you would create it.01:49:54And, the concept is the same. Concept is the same. Let me quickly show you a demo. So it's, it's going to use the APIs. So the 1st thing that we do is to add those API to create, to generate the API key.01:50:11On thousands I'm sorry on secure access, so we navigate to admin, API keys, add a new one, choose admin for the queue scope, and then integrations. And from here we choose MSA, which is acronym for.01:50:31Then on the scope on the right, as you can see, we get the read and write permissions. That's very important because we need them both. Okay, we click create.01:50:51We copy API key and key secret. We already revoked those so we are safe. Thanks for your concern. Then on Meraki dashboard, we can navigate to organization integrations and search for the secure access tile.01:51:05And essentially here, click connect and we add those values, those API keys. So as you can see, which is generated and they give them to Meraki, right? At the integration and by doing that, a new menu is going to show up over here.01:51:23I'm sorry over here. Okay, now that new menu will allow us to create the automated tunnels. We click on it, click on the sites. This is where we configure the the sites for.01:51:40Your sites, that's what I mean, to create the tunnels. We click on then we can search. If you have multiple, you want to search for the ones that you want to create tunnels for, e.g., San Fran, Chicago, New York.01:51:55Etc. We can search for them, choose whatever device whatever network device you want to create a tunnel with, assign a region closest to it, right, for secure access.01:52:11And after we select the region, bind that to the devices, then we click on next, save and finish, and that's it. That's pretty much it. You know, in the backend it's going to do the API calls, create the tunnels etc.01:52:28This is how it would look like you will have the ability to see that they're already connected. It will take one to 5 min for this orchestration tool to work completely and you will see the tunnel. Now if you navigate to secure access.01:52:45You can see under the network tunnel groups, the tunnels, right? That they are up and running, they're connected, you can see primary hub, secondary hub, right? It was all done automatically.01:53:01And, lastly, if you go to the access policy, you can see that now under, when you're creating a policy under from you can now choose these devices, these network groups as a source. So they're an identity as well.01:53:16Sorry you go. That's, that's what you would do. And with that we conclude the demo. All right. That's it. If there are any remaining questions, we will take a minute to answer them. I know we went a couple more minutes over the time.01:53:36But we appreciate you being with us. Thank you. There is a little question about the amount of users that we can support in the immigration tool that is a minimum, a maximum of 250 users.01:53:54And some of the customers telling us that they have, 2000 umbrella users in the policy, but if that if that identity is a group, it is content as one, right? So one group.01:54:13One identity. So it's not like one group, 2000 users, that means 2000 identities. So in the case that is like that is in that way you don't will have any problem. But e.g., if you have 2000 identities, different identi.01:54:31Identities roaming devices or things like that or different users, it will count as one, ok? So in that case you will need to adduce the policy to 250.01:54:51In the moment before you migrate and then migrate or you need to duplicate the policy and allocate the users in the duplicated policies before the immigration or the 3rd option that you have is reduce the policy in a maintained window.01:55:06Eh to one, then migrate and then insecure access and put the identities and in umbrella, put the identities again. So you will match all of them, ok? So that's the other thing that you can do. Op to resolve the question and if you have any other question, please go ahead and make the question.01:55:22Team, any more questions on the chat? I see a question from Martin Clark.01:56:02Slides are will not be available but the recording will be that's on the link that we shared earlier today. Let me put it once again here.01:56:23Oh, I'm pasting a link in the chat. That's where the recording of today's session will be posted after a couple of days.01:56:38Alright, you're welcome. Okay, if there are NO further questions, we thank you everybody and we wish you a great day. Thank you for joining us.01:57:05
About this Video
Author : Cisco Customer Success
Uploaded : March 12, 2026
AI summary
This recording shows a fast, low disruption migration from Cisco Umbrella to Cisco Secure Access using Upgrade Manager, unified Access Policies, and key integrations. It covers prerequisites, step two license extension, policy copy, and dual view traffic moves. It highlights Cloud DLP, malware scans for cloud apps, AI App Discovery and Guardrails, and Experience Insights powered by Cisco ThousandEyes. It demonstrates client management for Cisco Secure Client modules and root certificates, SAML and PAC updates, plus automated tunnels with Cisco Meraki and Cisco Catalyst SD-WAN. It ends with trust based access via Cisco Identity Intelligence.
- Learn how to run a four step migration with rollback.
- Enable Cloud DLP, AI Guardrails, and unified Access Policies.
- Activate Experience Insights and client management for faster troubleshooting.
Internal error
No related resources available.