What's new in Cisco Secure Firewall

Thank you for joining this for the what's new in the Cisco firewall overview. My name is Harry Davis. I'm a director of customer adoption for the secure firewall product joining me today leading.00:10Presentation are Alexander tourist.00:20And Gihannakana Kasia both customer success specialists for the secure Firewall product line. Before we start a couple of housekeeping notes, please feel free to ask questions in the Q and A section and our panel will answer as many as possible. We anticipate the material take nearly the full hour, but we will try to answer some questions live if there's, if there's time available. Once the event ends, we will.00:21Capture and answer any questions in a follow up email for all attendees. And finally, there'll be a short survey asking about the webinar and an option to request further assistance. With that complete, I will hand this over to Alexander to kick the session off. Alexander.00:42Okay, thank you so much Harry. Hello everyone. Welcome again, Welcome to this overview of some of the new features included in Cisco secure Firewall version ten.zero. Again, my name is Alexander Tores and along with my Colleaguehan will be covering some of the key highlights in this call.00:56We are both customer success specialists, we support our customers with their secure firewall adoption and engagements. So in the next hour or so, we plan to briefly showcase some of the configuration changes and hopefully answer your questions in the QA Q and A panel. Once again, welcome to the session. Let's get it started.01:16So, 1st of all, let's clarify that yes, the previous release number was version seven.x, if you, if you will know, and then we made the jump to version ten.X and from now on this is the approach that will be used on on of course.01:35I means to further simplify things and be consistent with support and certifications.01:55Working through the different coloring here in blue for the 1st year and this represents basically the mayor version. It is specified here by the 1st year. In this case it's gonna be ten.zero of course. So again, the initial release will be ten.zero.02:01Dot zero and the final release in the series would be ten.five.02:21So, which will deliver the final new features and the release submitted for if this is the release submitted for government certification. Now, when moving when we move into the maintenance release, think of this as just your standard release version, which is.02:26Highlighted here on the green color, this just provide bug fixes and vulnerability protections on top of that major release.02:46As you can see, you can have maintenance release published not only for the initial minor version but also for the final version of the stage. Vulnerability releases showcase here in white are also very every now and then published to cover discovery vulnerabilities of course before the next maintenance.02:55Release it available.03:16So again, we need to upgrade to the minor release to get the full 66 months of support. As you can see this slide here is showcasing that the initial and the final release is always gonna follow this ten.oh and ten.five pattern.03:24Pattern and on the minor releases, of course. All right, moving up to the supported platforms, this is more like a reference slide. These are the platforms supported on version ten.zero of course.03:41We will see some new entries on the firewall portfolio at the low and high end and in addition refreshing some of the hardware based fmcs. So not there's not really much to say here other than the continued virtual support in both public and private clouds as well as support for the firepower.04:01For the one hundreds and 9300 models on the ten.zero. But just keep in mind that.04:19This it's going to be supported only on the releases 4112 4115 4125 and 4145, right? So, so in order to operate this.04:27And then you need to be running at least version seven.three or higher.04:47So for the 1200 devices and basically for the 3100 series also this the file is the same that you use. You don't have to worry about like about upgrading FX OS or whatsoever. That's only gonna happen or we.04:53To be concerned on the 4190 300 series where do you still need to upgrade the fix OS before upgrading the.05:13The FTD versions ten.zero. So minimum version again is seven.three. The only caveat on that would be version on the device 1200.05:22Which supports a starting version like the minimum version this device supports will be seven.six so.05:38So the hardware that was included with this release at the 1st glance here you have the secure firewall 02:20 personal you said desktop form factor as you can see it has a fix for 1 gb internet and one SFP.05:56The internet ports is mostly address to modern next general NGFW use cases and it does support HA, it doesn't support clustering or multi instance.06:16Up to one dot 5 gb/s for NDFW traffic and 1 gb/s for IPsec VPN tunnels and up to zero dot 500 mb/s for TLS, one.two and one.three sessions.06:34And if the high end platform is gonna be the 6100 series. At some point it was it was decided to start using, well, it was evident that a new family or a series of devices was.06:52Required other instead of like including a new model in the 9300, basically the boss internal boss was already been exhausted with the new demands and the, and the.07:12This well of course the stress introduced with the the things like the demands by the way issued by the customers on on higher end platforms sorry.07:25Few more reference slides here so zero touch provisioning again is a feature that is was initial, initially geared towards the the load to meet end on the portfolio.07:42But it has changed over their releases with the goal to simplify the onboarding of firewalls and so the users only have to input a serial number when they are onboarding the firewalls with CDFMC. It has become completely optimized now and it reduces a significance.08:02We reduces onboarding time and removes the dependencies of the local device manager.08:23It does facilitate the onboarding of the device and the security cloud control on on prem fmcs. Okay, so, as per which are the new features included with the.08:29With ten.zero let's start with the thread and malware specific features. We will be talking about in this section, we'll be talking about some things that were included with if configuration and monitoring basically improvements in the, in the UI.08:47Of course simplify decryption policy or some changes also on the UI for that default port selection for app ID, we'll talk a little bit more about that later, and it's not enhancements so.09:05Let's start with the background why these changes and if we're required, so basically as.09:23As some of you might be aware if enhances, client application visibility detects malware communication, but configuration still was a little bit confusing for some of our customers. So the full protection requires decryption and the largest hurdle.09:29CCC of use, so this is definitely important point in here.09:48And trying to alleviate the stress when configuring features like this. For many applications, customers are unlikely to know which default ports are associated with an application. And security analysis cons constantly the newly discovered vulnerabilities to write snore rules to protect.09:52Networks, however, creating these rules is time consuming. So these were the challenges that need to be.10:12Need to be addressed, so for that, what was included in this version is that if now operating just two modes, the configuration was streamlined to do these these two modes monitor and protect, and then so the users can focus on the, on.10:18On what they, they intent that they for which they are trying to use the the feature, right? Same goes for decryption policy where the UI was also streamlined to a very much simpler process. Now concerning app ID detectors.10:37We included the option to select default ports when you are configuring application detectors in access control, so users don't have to worry about knowing the ports that are going to be inspected.10:56As not also supports now detecting HTTP command injection and trust site scripting attacks. So the features is is evolving as new releases are are are available.11:13So the benefits of course streamline if configuration is now always used for application detection, the concentrate on the intent of decryption policy, it's it's less complex for customers.11:28And we removed completely the the need for I mean of the customers to know, understand the default port for many applications. The requirements of course will be to have your FMC on version ten.zero.11:44And then these features are also supported only on snort version three. We'll talk a little bit more about them. So kind of like a quick rundown on encrypted visibility engine in case some of you are not familiar with it, what does encrypted visibility engine provide?12:02It's a feature that is aimed to provide visibility on applications and malware detection without the the hustle or the struggles of of having to configure an encryption policy. So basically without a decryption policy.12:22If will elaborate fingerprint based on the SNI of the certificate used to establish as a connection to determine if the traffic in question is malicious or to enhance the application detection capabilities of the firewall for encrypt.12:40The traffic, right? So even without decryption, if we'll be able to.13:00Categorize an application as a trusted application or not. Basically, this is how the fingerprint will look and it's well one of the cool things about if is besides the fingerprint is that it will also use destination context to determine or to like increase the.13:04Likelihood or or the confidence that a certain process is actually being properly classified.13:24Again, all of this happens without the firewall having like a decryption policy configured. You could you could easily have if enabled and done enable the decryption policy if that if that's a problem and then you will still be able to use the benefits of having if there.13:32So this is just another example on how the destination context works and if as you can see here there is in this example there is a 7070 3 % of the connections with this fingerprint and if database originated from the Chrome bro browser.13:56So basically only 73 % of those of those connections where this fingerprint was found are originated from Chrome browser. However, the destination IP address.14:16That this used this connection says that of those 73 % connections 99 % of them are destined to the IP address that was used in this specific connection which gives us just like the chance to increase the confidence, the level of confidence to almost like 100 % for this.14:35Specific connection. That's how if operates and helps you identify like encrypted traffic without the decryption, right? So, as you can see the result was that there was a 98 % process confidence score.14:56To identify from a browser in this case. Again, this is still for a quick connection. So this feature is not new, it has been in place for quite some time now.15:16However, what is new on a version ten.zero is that we have a new dashboard as you can see here the dashboard illustrates it.15:31Greatly shows showcases the capabilities of if and also the way you configure if now it's on an access control policy it will have its dedicated menu here is NO longer part of advanced section, and as you can see in this example here, we only have these two modes monitor.15:46And protect mode. If you want to enable the monitor mode, it will only detect client applications and raise indications of compromise, so it basically won't take any action on the actual traffic, it will just deliver alerts based on on the, on what it finds, right?16:06You can also specify high or very high block connections with their level of confidence, which is also different from what we used to have before, on the previous releases.16:25Where users had the option to well be more specific on like percentage of confidence, but that as it was mentioned just increased like the the complexity of having these deployed and actually adopted, so this makes things.16:41Easier to be deployed and still well serve the purpose of the feature so as far as talking a little bit about decryption policy, the aim is very similar.17:00To that of if we basically simplify the configuration of the decryption policy, the focus on what the policy should do and not how to generate the policy which is, it can be.17:21Confusing, right? So, basically, as you can see here on this slide, screenshot screenshot and we will also show a quick demo in a few minutes but basically we have the option to specify like a standard policy type of standard policy type.17:36Where.17:56We use the new interface as a default mode for ten.zero or we can still use the legacy mode and as you can see the differences are will be very significant here. This is on legacy mode where you have to specify like a granular mode for specific rules. It's basically a rule based approach.17:58Where you had to specify source and destination, networks for which you wanted the traffic to be decrypted. On the standard decryption policy, there, there are NO longer like rule sets there is a simple and guided configuration with some pretty fine bypasses. And.18:18You can still specify source destination zones, but it's very much more intuitive now and easier to configure. So the rule based decryption policy is this basically requires requires careful rule ordering to avoid decryption.18:37And it is still recommended for complex and exceptional use cases. However, this standard decryption mode now is organized and tile layout for inbound and outbound bypass and blocking of policies. So it's their rule ordering is automatically.18:55Managed now. So it's more like focus on intent and not on the sequence, right?19:15Oh, so one of the things that is also included in this version is that quick is NO longer an experimental mode. You will see that there there's NO longer this flag for experimental experimental mode on quick decryption.19:25So this is now a fully supported feature and you are encouraged to start using. As you may know, well, quick traffic is exponentially increasing now onto today's networks environments. So let's talk a little bit about app ID.19:42And the default port specification, what is this about? So in a well basically in previous versions, whenever a user wanted to block.20:02Traffic based on their on the application that was being configured, you will users will usually specify the application and don't really care and wouldn't really care about the port that is actually being used to identify that application or to classify the traffic as a result.20:18Every, every connection destined to the source and destination IPs regardless of the port will be subject to inspection of the application by the application detector.20:38Which will of course increase the likelihood of a well it is just not efficient enough for well the app ID detector itself and also.20:50And it can increase the likelihood of of secure of security impact given that the application detectory does require some of the packets to be allowed through the FTD before an actual decision is taken concerning the application detectors themselves. So that was an issue.21:04With the default port specification option now, users don't really have to know the the ports that are the default ports that are used by the applications they are trying to identify some, on some cases like in gaming applications, users may not be aware of.21:24Which ports are being used, right? So, with the default option, what you can do what just with the, this simple option you will have freedom to configure application detectors without having to specify ports and still gain the benefits of.21:44Not having to increase the, the, the potential impact on, as I mentioned before, of having them like the whole range of ports open for application inspection. So again, if multiple applications are added to a single rule.22:03Each application will match only against this specific default ports.22:23So if we specify SSH or HTTP only their specific ports would be inspected or subject to application detection. So basically snort email was originally introduced back in seven.six simply put snort machine.22:28Learning protects you from vulnerabilities where we don't have an IPS rule yet. So by defining by definition when a zero day vulnerability of which NO one knows about is being exploited, it'll be hard to build a rule for those.22:48For those, threats, right? So instead what Cisco is shipping that we are shipping is a machine learning model to the firewall that recognizes this is a slight variation of the specific attack. So again, this person, this feature was already supported.23:07However.23:28What it how it does is like it's how it works is basically includes an additional inspector to snort with a network based exploit approach for snort tree. The model learns about attack patterns and a generalized detector of known and unknown exploits is finally delivered.23:29Unavailable when the rule is engine is enabled.23:49So in practice it will look just like a regular intrusion rule or event, right? Just a regular intrusion event is generated anytime an identified malicious activity is found.23:53Yes again, as I said before, this was introduced back in seven.six back then it provided support only for SQL injection type attacks and then in the new release it now supports HTTP command injection attacks. And in the future it's going to have more coverage as we iterate the releases, but things like crosses.24:12Scripting attacks are now as supported on snort ML.24:32And then of course with this release under the hood enhancements have also been fine tuned. So let's take some time to briefly review the configuration of some of these features. Please take control of the screen.24:37Thank you, Alex. I'm going to share my screen now. So this is going to be a high level overview of some of the features that were mentioned during the presentation by Alex. So we know that today almost all the web traffic is encrypted. So.24:55Pretty much decryption is more critical than ever before. So we're going to start by taking a look at the decryption policy. And as Alex mentioned, both in in Cisco has simplified this process by moving from this traditional, let me show you this policy which is a traditional rule.25:13Based interface. So this is the way that decryption policies or SSL policies used to be.25:33The rule. But now we're moving to a new intent based workflow. So this new decryption policy actually it it as you can see, it still works with or remains supported the decryption policy with rule based. This is something that you can.25:41Still do. You can continue to build your new policies using the older rule based method. On the other hand we have the decryption policy which pretty much you have to give it a name and a description to create a new decryption policy, that would be it. It will look something like this one.26:01So this is the new view that you will see. One thing to notice here is that the existing decryption policies are not automatically converted to the new design. They are going to remain supported, but you will need to work on this new model now. So as you can see, we have different options.26:20We have inbound decryption and outbound decryption. So as name says, inbound decryption is when the firewall decrypts traffic coming from external clients to an internal server and well there are a couple of things that needs to be configured in this part.26:40Starting with the security zones. So here you will have your security zones and in this case that will be something coming from the outside as a source coming to the inside as a destination and hit save.26:57And other than that, well, you will need to configure the internal server details section, pretty much specify the decryption targets, define the traffic that will be decrypted by adding entries to this part. So if I add a new entry, it will ask.27:11For the internal certificate destination, network and port of the object. That's pretty much it. I'm not going deep on this demonstration but as you might see on the chat, we are hosting additional sessions to go deeper on each of these features.27:32Now for the outbound decryption, we can see we have plenty of different options. Again, as name says, this outbound decryption is when the firewall decrypts traffic coming from internal clients out to external destination servers, right? So.27:50The firewall will perform decryption by generating on demand certificates via an enterprise certificate authority and that will allow the firewall to inspect the connections. So in this case, we also have to configure.28:10Well, 1st of all enable it and configure the security zones. That case something coming from the inside to the outside. And as you can see here, we also have the internal certificate authority. So we have to choose the certificate authority keeper that the firewall will be used to.28:25Sign replacement, the TLS certificates. That should be here. You can always create a new certificate from here.28:45Or just let one that you already have. And we also have to add additional entries under decrypt networks and users. I guess we need to define what's gonna be decrypted and in most enterprises the outbound decryption is not enough.28:52Most of them require bypass rules, so you can see that for these outbound decryption we have different bypass sections here. We can bypass by source and destination, users, applications, URL categories, and I want you to notice that we also have the intelligent decryption.29:11Bypass. This one provides a dynamic risk based bypass to preserve performance by.29:32The skipping inspection of the low of risk connection, right? And we can also block specific connections. So, of course we're going to cover this in detail in the coming session, but that's pretty much it. That's how it looks right now, this new model. And now I wanted to show you.29:39Some other features. Yeah I'm not going to save that for now. I wanted to show you now the advanced logging. So this is something that we haven't covered yet on the presentation, but a new feature is the advanced logging and in order to enable advanced logging, you have to go to.29:59To advanced settings.30:19If you scroll all the way down, you will find the advanced logging option. And if you click on the pencil, this is going to show this pop up window. You just have to enable this checkbox right here in order in order to enable the advanced logging and you have to select a format. This could be JSON CSB or TSB.30:20That's depending on what you need. And we have two different options here. So one is to send these logs to other destinations, it could be Splunk profiles or syslog.30:41And the other one is to use existing logging settings. So I'm gonna keep it with this option and save. And when I mean existing logging settings is by going to this dropdown menu and if you go to logging.30:53You will find this information if you are sending the logs to a syslog server and will be the destination. And also well in this case I have this checkbox well checked and I am sending all the syslog messages for intrusion and malware events.31:10To this Splunk destination, right? So this is the default logging settings that we're going to be using, it for this matter. Now, real quick, this is encrypted visibility engine. The only difference is that now we're seeing encrypted visibility.31:29The Engine on a different tab here. This one used to be part of the advanced configuration as well. It's not anymore. Right now we can see encrypted visibility from here. You can just enable it.31:49Selecting monitored traffic that won't affect your your traffic at all or you can select the protect option that will block all the encrypted traffic based on the threat confidence level, and we have two different options. It could be high or very high. In this case I I go with very high option.32:00Right?32:20Now, one more thing that I wanted to show you is the snort ML. So for a snort ML, we mentioned that this is a new an additional intrusion rule, so I'm going to the intrusion policy. And now.32:21Let me go to the snort three version of any of my policies.32:41And in order to enable the snort email we have to actually, you know, change the action of the rule, the snort rules, so I'm going to click view effective policy. Just make sure to select all rules and I'm going to use this search bar by using the EID.32:45Which is 411.33:05That will show the snort ML rule. As you can see, we can find different details here including the message that you will receive once that you get any intrusion event. It would say that this one, this one was detected by snort mL, which is a potential.33:09And the only thing that you have to do is to change the action. As you can see by default, this one is disabled, so you just have to change that to block, click override, and that should be it. Now you have a snortable enabled.33:31The only thing that remains is I'm going back just real quick to the access control policy here and remember that in order to, have snort ML working or inspecting the traffic, you have to add the intrusion policy per rule, so if you.33:49Click on the pencil on each, on any of the rules, this one is actually blocking but well 1st here, as we enable the advanced logging, you will have another option for advanced logging, which is turned off by default, of course.34:09But if you click here, it will show the different applications that you can select, could be FTP HTTP, and depending on each of these applications, well, it will match the traffic. E.g., HTTP will log the data collected for the HTTP response, the method, the header, and the status code, right? So.34:26So you can just confirm this and apply.34:46In that case you will be using the advanced logging and that will be the same for the intrusion policy. You will need to enable intrusion, the intrusion policy or applied intrusion policy per rule as well. So again, this was a pretty high level overview of some of the features that we just mentioned. I hope.34:50This you find this useful and with that I'm passing the ball back to Alex.35:09All right. Thank you so much, Johann. I was going through some of the question here. I will try to answer them by the end of the session if some of them are, are not answered yet, but anyways, let me share my screen one more time.35:18Right, so, let's jump to SD one, thank you so much Johan for that brief review. So basically what what's new on SD one for we have a couple of features we now support carrying security group tax over side to side.35:39Tunnels.35:56And we can now implement ECMP and BFD fault detection on the VTI interfaces. So why was required? Historically, Cisco trustsec has been a cornerstorm for network security so utilizing role based access control to identify users and the.35:57Devices beyond just their IP addresses.36:17All managed centrally by ICE. So this allowed for dynamic policy enforcement, but then regarding traffic flow, we've always been able to load balance traffic initiated from a spoke to hub connections. However, our limitation was that the hub to spoke communication couldn't be load balanced, which could impact performance and.36:20Is silence in certain scenarios. What's new in the release 1st we've added the ability for both dynamic vtis and static vtis to receive and propagate security group tags, sgts.36:40Is this was crucial step towards the extending our security posture. And second, we've addressed the hope to scope, hope to scope, hope to spoke load balancing challenge. Hope load balancing via multiple paths to a given spoke is now fully supported.36:58Through the addition of ECMP and BFT.37:18So these new features of course deliver substantial benefits. Firstly, you'll experience enhance and extended security by enabling SGT propagation across your SD WAN fabric, you can achieve more granular and consistent security policies.37:22Which translates into better protection, more precise control over your network traffic and significantly simplified security management experience. Secondly, we're delivering proofed network performance and reliability.37:38With the new hub low balancing capabilities still benefit from optimized traffic distribution, leading to increased bandwidth utilization and better application performance. This is crucial because it means basically higher availability for your spoke sites resulting in a more resilent and efficient.37:54Network infrastructure around.38:14So, of course, the requirements for that is that your FMC is running version ten.zero and also your FTD to leverage these features. So the next is for carrying those encrypted SGT across your SD one fabric.38:17So dvtis and svtis can receive and propagate those security group tags across the tunnel. And then again if needed, you can mix FTD and ASA devices in your deployments. So here's what the configuration will look like.38:37It's actually pretty simple under the device management page, you will find an added checkbox when you go to create a VTI interface. And again, this is the checkbox and again the goal of this is to enable your consistent and.38:55And granular security policy for your micro segmentation across your distributed network environments. Now with the ability to configure ECMP and BFD on the VTI interfaces, we can now provide session connectivity.39:13An application resilience across multiple paths more efficiently.39:34With the CMP we have the ability to route packets to a destination via multiple equal cost paths, and then currently with that peer detection there is a minimum of 20 s to detect a down peer. So this is where we now leverage the directional forwarding to detect faulty BTI faster.39:38In a few milliseconds.39:58So let's review some of the FMC specific improvements included with this release. So we've had we have added that direct integration with the Splunk in the FMC and some additional advanced advanced login capabilities.40:09The on premises FMC navigation received some customizable updates as well as the upgrade wizard and the model migration received some other updates as well. So, let's take a look at the background here previously while Syslog offered better performance for integrations.40:25Than streamer.40:45Its configuration was often complex and had fewer features. Many users also found the process of selecting a device for upgrade very unintuitive and cumbersome. And a key customer expectation was also that they want upgrade to the new hardware, new hardware their existing configuration should.40:47Seamlessly transferred. So to address these challenges, the new features are that we have introduced a new wizard and simplifies the integration with Splunk, access control rules now feature a new configuration menu for advanced login as was mentioning before.41:07And the upgrade wizard has also received a complete overhauling with a new layout and improved features. The FMC navigation has been simplified aligned with our security cloud control initiatives. And additionally FMC and FTD model migrations are.41:25Were included Options were included. So the benefits of course is that we have better seem integration due to syslog configuration and enhanced event options. The operates are now significantly simplified.41:45This makes the upgrade process more intuitive and less cumbersome. We are also ensuring a consistent user experience to facilitate a smoother transition for customers who wish to move traditionally from traditional on prem deployments to a cloud.42:041st model.42:22And critically you can expect seamless configurations during migration, meaning your current configurations will be maintained when refreshing your newer hardware. All of these features are available on FMC ten.zero. So this is basically how the new UI looks on the ten.O.42:25As you can see, you have the option now to customize the menus.42:45As you will based on your preferences. A lot of users were well some users were also not satisfied with the fact that a lot of menu options were visible on the FMC. So one of the changes was that we removed the system menu.42:49Which used to be on the top right corner here with an engine like like icon and it was moved to the, to be within the administration menu over here.43:09We also included the troubleshooting menu which includes the options to run packet captures and run packet tracers from the FMC UI, but yeah, as a key highlight here we can.43:21We can basically customize our our menu and remove the options that we don't need based on your usage regular usage.43:39This is about the Splunk configuration on the FMC, so as you can see, this offers improvements in in simplifying the old syslog configuration with this direct interaction, there's NO need to use e streamer or established communication with your.43:57Splunk instance. As notice here on this video under the integration tab, there is a dedicated Splunk page. Let me run this again. Okay.44:16There is a dedicated Splunk page and now let me just run this again to where you will build these profiles and then you can go through the configuration, you will see a list of profiles in here. And then when configuring we can pick up our servers.44:36And choose our event types as we will also we can specify here the devices as needed. And just keep in mind that these policies are additive, that means that they will be as new profiles are configured, you will also be, those profiles will also be applied to the.44:54Devices if they are selected in the configuration.45:14It's a little bit more of the same and then advanced login as I was mentioned before and there's also more granularity when it comes to logging we can leverage to generate logs with a more granular data for DNS FTP and HTTP.45:24There's also support for end of connection data intrusion event and the goal is to provide our systems from having access to data collected from all passing traffic.45:41And this provides insights into security threats and operational performance so concerning migration, we announced.45:56So, the migration feature is of course has been integrated on in past releases. This feature allows you to migrate different things like interface configuration, routing configuration, DHCP, brfs, and some objects. So with the version ten.zero, we're adding the same ability but with some additional.46:14Models to.46:34So you will have the option to migrate devices to specific configurations anywhere from the 1010 to the 93 hundredths and to the 1200s or to the 4200 series. So for a built in FTD model migration, we started with FMC ten at zero.46:36Now allows administration as administrators to choose a source device within the family of 1000 series through 9300 series and the target device can be a secure firewall 1200 series or 4200 series.46:56So some of the things are included on identity, let me run through this a little bit faster. So we have dynamic firewall leverage. We also leverage multiple ice clusters and identity traceability tools.47:21So a quick background check. This was needed basically customers require better visibility into users and devices to enforce policies effectively. While we currently achieved this through the integration with ICE or Cisco identity intelligence large network deployment of send involves multiple ice clusters, which.47:37FMC hasn't, I mean so far it wasn't able to fully leverage.47:57Furthermore debugging and analysis analyzing user session across complex multi component environments can be challenging as understanding a user's path is crucial. So what is new on version ten.zero is that we the dynamic firewall wizard.48:02Was introduced to help associate an identity source with identity intelligence. And also multiple ice clusters are now supported on the FMC using either on prem or PX grid cloud. The CLI based identity traceability tool automatically retrieves session fidelity and.48:19Compiles it into a structured table very silly, for easy to review.48:39So these requirements, of course, the requirements for that is that the FMC is running version ten as long as as the FTD and the FMC is managed ftds only, right? So it's it's not going to be supported on FDM. FTD supports for multi eyes and dynamic firewall require.48:49To be seven.3X and above for active directory realm.49:10And seven.four and above for Azure Active directory. So what is dynamic firewall? The feature itself is the new wizard in the FMC under your dynamic attributes connector.49:13This capability allows you to integrate with ICE for say device attributes, attributes and then with Cisco identity intelligence for your user intelligence, but Cisco identity intelligence does, it it collects user information from your different identity sources. So say when.49:33There, whether that be duo or something like intra ID.49:51That we also support with this feature. So it can then classify user patterns into five trust levels. So anywhere from trusted to untrusted, then where we leverage this is in the FMC to get the untrusted and questionable levels from.49:55Cisco identity intelligence.50:16And apply to logins received from ICE or PX grid cloud. Again, we are also forwarding the capabilities of the FMC by giving you the ability to have it receiving feeds from multiple ICE clusters. The goal here is was to scale.50:18Reasons, of course. Now you can get user sessions and SXP mappings from multiple ICE clusters behind a PX grid cloud application instance. This gives you flexibility to security groups and endpoints profiles directly in your access control policy.50:38So some of the highlights on public and private clouds, ASAV now supports support for clustering and auto scaling google cloud platform based instance support for FTDB and ASAV in Oracle Cloud.51:01And DPU acceleration is now supported on ASAV on KVM. FTDVU is a new form factor of licensing through the support VMware and key KVM.51:19So why was this required basically on Google cloud protection platform adoption so we then need to support dynamic scaling on both ftds and asavs and Cisco, well why we we offer arm based hardware appliances, there is NO support, there was NO support for.51:34Virtual appliances are armed architectures.51:54So currently FTD is also constrained to a maximum of 16 virtual CPUs, and so some customers wanted to have more capabilities on cloud environments so we need to provide a solution to that. So what's new is that what's new is that on Google Cloud platform now clustering.51:58It's supported with auto scale for ASAV.52:18And Oracle Cloud is also now fully supported of arm based ASAV and FTD instance. DPU acceleration is now supported for ASAV on kvmiss which allows the virtual machines to run IPsec and.52:21Flow of load acceleration capabilities and and over the DPU.52:41So, VMware KVM does support unlimited new tier license. Of course, this allows you to just see increase increase scalability and performance. This means your security.52:46The infrastructure can adapt automatically to changing demands.53:06And we're providing expanded deployment options of course so yes, this I already mentioned before, so basically ARM is now supported on the ASAP and ftdbs.53:11And this is basically what the universal form factor license, how it would look like only with it, well, on the on the FTDB when you specify or register the FTD on a FMC. So that brings us to the end of this presentation, I kind of like kind of rushed.53:33For the last minutes because I I wanted to have some minutes to answer some of the questions. But if you have if you would like to have more details about what we discussed, you can always check the release notes. As Harry was mentioning, we will also be discussing like more detailed features in upcoming releases including some of the.53:51Ones that I see that have been mentioned in the in the chat.54:11So, I'm gonna stop sharing my screen now. Thank you all again for spending time with us in this topic. A lot of great questions, I think we answered some and some we didn't what I will do is I will filter them out and answer them in a follow up email.54:15And then we will you know present that so you get the opportunity to see some answers with some links in it.54:35All right. I did see one question that just popped in. Last one is does FMC ten.X forward logging and advanced logging has two independent data sources that the team will ingest separately? And.54:41No, I know I'm on, I completely agree. We'll take some of these topics here and what we'll do is we'll bring we've been doing a series on kind of feature focus and that's definitely something we'll be doing going forward over the next couple of over the next couple of quarters. We will dive into some of these some of these topics, some of the good feedback you gave us. So again, appreciate that.55:02I will, we will answer these questions offline and send out an email. With that please thank you again and enjoy the rest of your day.55:22