Integrate Catalyst SD-WAN Manager with Security Cloud Control

Overview of Catalyst SD-WAN integration with Security Cloud Control Firewall Management

You can use Cisco SD-WAN solutions, including the Catalyst and Secure Router series, with Cisco security portfolio to control and manage network security features.

The integration of Security Cloud Control Firewall Management and Catalyst SD-WAN Manager provides centralized management for Cisco Catalyst SD-WAN and Branch WAN environments. This enables organizations to configure, monitor, and enforce security policies across their networks. It also facilitates advanced troubleshooting, rule optimization, and change management on Catalyst SD-WAN Manager.

Benefits

This integration allows you to:

  • Efficiently manage security policies and objects, configure and edit them, and push changes using the Security Cloud Control Firewall Management dashboard.

  • Effective monitoring and detection of security threats from a centralized Security Cloud Control Firewall Management dashboard.

  • Analyze security threats from logs and events in the Security Cloud Control Firewall Management dashboard with data sent from Security Analytics and Logging.

Security Cloud Control Firewall Management provides these capabilities:

  • Security Discovery: Identifies existing security configurations and policies through the onboarded Catalyst SD-WAN Manager.

  • Policy Creation: Enables the creation of new security objects and policies using its platform.

  • Cohesive Strategy: Supports a cohesive strategy for implementing security objects, policies, and profiles across multiple Cisco solutions.

  • Log and Analytics Viewing: Offers capabilities for viewing logs and analytics data.

  • View intrusion and malware events: Displays intrusion and malware events detected within the network from Secure Router.

System topology diagram

The primary use case for managing the Next-Generation Firewall (NGFW) capabilities of Catalyst SD-WAN through Security Cloud Control Firewall Management is to streamline and centralize security management across Cisco's security products.

The topology diagram illustrates the integration of Catalyst SD-WAN with Security Cloud Control Firewall Management and other cloud services. The diagram shows the flow of information and interactions between various components.


Note

The Cisco Catalyst 8000 and Secure 8000 devices are collectively referred to as the 'Secure Router' hereafter.
Topology diagram showing the integration of Catalyst SD-WAN with Security Cloud Control Firewall Management and information flow between components.

  • Security Cloud Control: A central point for security policy enforcement and event correlation. It reads Next-Generation Firewall (NGFW) policies and security objects from the onboarded Catalyst SD-WAN Manager and allows customers to modify these NGFW configurations. It also sends queries to Cisco Security Analytics and Logging cloud data store for events.

  • Cisco Catalyst SD-WAN consists of:

    • Catalyst SD-WAN Manager: Manages the SD-WAN fabric and displays NGFW policies and security objects in Security Cloud Control when onboarded to it. Catalyst SD-WAN Manager sends the event data received from Secure Router to SD-WAN Analytics.

    • SD-WAN Analytics: Provides analytics data to the Security Services Exchange.

    • Secure Router: The SD-WAN edge device.

  • Cisco Security Analytics and Logging Cloud Data Store: A cloud-based repository for security analytics and logging data. It receives security events and logs from Security Services Exchange, which obtains the analytics data from SD-WAN Analytics engine.

  • Security Services Exchange: A cloud-based platform designed to facilitate the integration, communication, and management of various Cisco security services. It sends security events and logs received from the SD-WAN environment and forwards them to the Cisco Security Analytics and Logging Cloud data store.

End-to-end workflow to manage Catalyst SD-WAN Manager using Security Cloud Control

This flowchart illustrates the high-level workflow for managing the firewall capabilities of Catalyst SD-WAN Manager using Security Cloud Control.

Flowchart showing the workflow for managing the firewall capabilities of Catalyst SD-WAN using Security Cloud Control.

Step

Application

Description

1

Prerequisites

Onboard your SD-WAN Analytics services to Catalyst SD-WAN Manager and enable data collection. For more information, see Onboard Cisco SD-WAN analytics.

2

Security Cloud Control

Onboard your Catalyst SD-WAN Manager. The onboarding process also imports your associated Secure Router routers. For more information, see Integrate Catalyst SD-WAN Manager with Security Cloud Control.

3

Security Cloud Control

Create, modify, or delete Catalyst SD-WAN security objects, security profiles, and Next-Generation Firewall (NGFW) policies. For more information, see Manage objects and profiles and Manage NGFW policies.

4

Security Cloud Control

Associate a policy group to your Catalyst SD-WAN NGFW policy. For more information, see Associate a group policy.

5

Catalyst SD-WAN Manager

Deploy the policy group to Secure Router routers. For more information, see Policy groups configuration.

6

Security Cloud Control

View the security events received from Catalyst SD-WAN with Security Analytics and Logging for monitoring and threat detection. For more information, see Security Analytics and Logging (Saas) for Catalyst SD-WAN Devices.

Minimum software requirements

Minimum software requirements for Catalyst SD-WAN integration with Security Cloud Control Firewall Management:

  • Catalyst SD-WAN Manager supported versions: 20.18 or later

  • Secure Router supported versions: Devices supported by the last two versions of Catalyst SD-WAN Manager are compatible from version 20.18 onward. For example, if you use Catalyst SD-WAN Manager version 20.18, devices from versions 20.15 and 20.12 are compatible.

    Contact Cisco TAC to check which indexes are not compatible, and remove any incompatible indexes. For more information, see Cisco SD-WAN Control Components Compatibility Matrix.

Alignment of RBAC models of Security Cloud Control Firewall Management and Catalyst SD-WAN Manager

User roles in Catalyst SD-WAN Manager and Security Cloud Control Firewall Management operate independently, with each role defined by its specific responsibilities. However, the Role-Based Access Control (RBAC) models across these platforms are aligned to ensure consistent and seamless user actions.

A user with elevated permissions in Security Cloud Control Firewall Management may still encounter restrictions if their role in Catalyst SD-WAN Manager has lower permissions, and vice versa.

Attempting to save changes in Security Cloud Control Firewall Management without appropriate permissions in Catalyst SD-WAN Manager results in an error. For example, users assigned the 'Super Admin' role in Security Cloud Control Firewall Management cannot save NGFW security policies changes to Catalyst SD-WAN Manager if they have the 'Operator' role in that platform.

This table outlines the access permissions for various combinations of user roles in Catalyst SD-WAN Manager and Security Cloud Control Firewall Management.

Table 1. RBAC mapping of user roles in Catalyst SD-WAN Manager and Security Cloud Control Firewall Management

Security Cloud Control Firewall Management Role Name

Catalyst SD-WAN Manager Role Name

Allowed Actions

Read Only

Operator

Allowed read-only access in Security Cloud Control Firewall Management

Allowed read-only access in Catalyst SD-WAN Manager

VPN Sessions Manager

Operator

Allowed read-only access in Catalyst SD-WAN Manager

Administrator

security_operations

Allowed to create/edit security policies in Security Cloud Control Firewall Management

Allocated SecOps user role in Catalyst SD-WAN Manager

Super Administrator

security_operations

Unrestricted access to all functions in Security Cloud Control Firewall Management

Allocated SecOps user role in Catalyst SD-WAN Manager

Deploy Only

Operator

Not allowed to create/edit security policies in Security Cloud Control Firewall Management

Allowed read-only access in Catalyst SD-WAN Manager

Edit Only

security_operations

Not allowed to onboard or deboard Catalyst SD-WAN Manager

Unrestricted access to all functions in Security Cloud Control Firewall Management

Allocated SecOps user role in Catalyst SD-WAN Manager

Onboard Catalyst SD-WAN Manager to Security Cloud Control

Use this procedure to onboard Catalyst SD-WAN Manager to Security Cloud Control platform.


Note

After you onboard Catalyst SD-WAN Manager to Security Cloud Control, security operations (management of policies, objects, and profiles) can be carried out only from Security Cloud Control.

The version control feature is not supported in Security Cloud Control.

Before you begin

  • You must have Smart Account Administrator or Virtual Account Administrator privileges on a virtual account linked to a controller profile containing the information of the organization you want to onboard.

    For more information about Smart Account and Virtual Account, see Access the Cisco Catalyst SD-WAN Portal.

  • You must have the Organization Name of your Catalyst SD-WAN Manager because it will be required during onboarding.

    1. Log in to your Catalyst SD-WAN Manager.

    2. Choose Administration > Settings > System > Organization Name.

      The Organization Name field contains a unique identifier that establishes secure control connections within the SD-WAN environment.

  • Enable Service Access Authorization to ensure the onboarding process completes successfully.

    1. Log in to your Catalyst SD-WAN Manager.

    2. Choose Administration > Settings > Cloud Services.

    3. Enable Cloud Services, Analytics, and Service Access Authorization.


Note

All Secure Router devices managed by Catalyst SD-WAN Manager are onboarded to Security Cloud Control regardless of their Device Status.

  • You must have either an Admin or Super Admin role on Security Cloud Control.

Procedure

Step 1

In the left pane, choose Administration > Integrations > Catalyst SD-WAN.

Step 2

Click the icon at the top-right corner of the Catalyst SD-WAN tab.

Step 3

Alternatively, you can use the Get started with Security Cloud Control interface to onboard Catalyst SD-WAN Manager.

  1. In the top menu, click .

  2. Click the Manage firewalls tab.

  3. Click Onboard on the Catalyst SD-WAN tile.

Screenshot of the get started with Security Cloud Control page.

Step 4

From the Select Organization drop-down list, choose an organization.

The list of organizations displayed in the drop-down depends on the region where Security Cloud Control is deployed.

Step 5

In the Create label field, enter the desired label and click Connect.

After you onboard the device to Security Cloud Control, the system applies labels. You can use these labels to group devices and filter them on the Security Devices page.

Step 6

Verify the details on the Catalyst SD-WAN Manager you are onboarding, and then click Close.

In the Services page, the Catalyst SD-WAN displays the onboarded manager.

After a successful onboarding, these details are displayed in Security Cloud Control:

  • All security objects, security profiles, and NGFW policies. The system displays these imported policies in Policies > WAN Branch Edge.

  • Secure Router devices and their running configuration.

What to do next

In the Management pane, click Devices to see the onboarded Secure Router devices.

Deboard Catalyst SD-WAN Manager from Security Cloud Control

Deboarding Catalyst SD-WAN Manager from Security Cloud Control automatically removes its associated devices, policies, and objects from Security Cloud Control.


Note

When you deboard Catalyst SD-WAN Manager from Security Cloud Control, all the policies and objects created through Security Cloud Control are deleted from Security Cloud Control but remain in Catalyst SD-WAN Manager. You can then edit security objects and policies from Catalyst SD-WAN Manager.

Procedure

Step 1

Choose Administration > Integrations > Catalyst SD-WAN.

Step 2

Select the manager that you want to delete and click Remove SD-WAN Devices.

Screenshot of the Integrations page showing the Remove SD-WAN Devices button.

Step 3

Click OK to confirm the action.

How Security Cloud Control Firewall Management manages Catalyst SD-WAN NGFW capabilities

When Catalyst SD-WAN Manager is integrated with Security Cloud Control Firewall Management, the existing Next-Generation Firewall (NGFW) policies, security objects, and security profiles from Catalyst SD-WAN Manager are automatically imported into Security Cloud Control Firewall Management. You can modify these NGFW parameters or create new ones in Security Cloud Control Firewall Management. Any changes you make in Security Cloud Control Firewall Management are synchronized and saved in Catalyst SD-WAN Manager.

After Catalyst SD-WAN Manager is onboarded to Security Cloud Control Firewall Management, you can no longer manage policies, objects, or profiles through Catalyst SD-WAN Manager. You must manage them exclusively from Security Cloud Control Firewall Management.

A "Managed by Security Cloud Control (SCC)" banner is displayed on Catalyst SD-WAN Manager that is onboarded to Security Cloud Control Firewall Management, indicating the integration. You can view this message in Catalyst SD-WAN Manager by navigating to the relevant configuration sections.

  • For Security Objects and Profiles: Choose Configuration > Policy Groups > Objects and Profiles > Security Objects.

  • For NGFW Policies: Choose Configuration > Policy Groups > NGFW

Restrictions for Security Cloud Control Firewall Management and Catalyst SD-WAN Manager integration:

  • Cloud connectivity is essential

    Catalyst SD-WAN Manager can be deployed either on-premises or hosted in the Cisco cloud. To function properly, it must have cloud connectivity. If Catalyst SD-WAN Manager is placed behind a NAT device, it is supported but with restrictions. Specifically, only port 443 (HTTPS) needs to be open to enable cloud connectivity.

  • Deboard Catalyst SD-WAN Manager to edit NGFW policies, objects, and profiles

    To make changes in NGFW policies, objects, and profiles from Catalyst SD-WAN Manager, you have to deboard it from Security Cloud Control Firewall Management.

  • Customized IPS profiles not supported

    You cannot edit or customize IPS policies (Signature set objects) within security profiles.

  • Live logs unavailable with SAL

    Live logs cannot be viewed on Security Cloud Control Firewall Management using Cisco Security Analytics and Logging. You can only view historical events.

  • Modify user role privileges for Security Cloud Control Firewall Management users with caution

    Exercise caution when changing user role privileges on Catalyst SD-WAN Manager for users who are part of Security Cloud Control Firewall Management. Modifying privileges for Security Cloud Control Firewall Management-associated users can result in configuration failures.

  • On-premises multitenant Catalyst SD-WAN Manager not supported

    On-premises multitenant deployments of Catalyst SD-WAN Manager are not supported in Security Cloud Control Firewall Management for version 20.18.1. In this release, only single-tenant Catalyst SD-WAN Manager deployments are compatible with Security Cloud Control Firewall Management.

  • Dark mode not supported

    Keep dark mode disabled in Security Cloud Control Firewall Management when Catalyst SD-WAN Manager is integrated.


Note

Changes to NGFW policies, objects, and profiles can only be made in Catalyst SD-WAN Manager after it has been deboarded from Security Cloud Control Firewall Management.

Security Cloud Control Firewall Management allows you to perform these operations:

  • Create, modify, or delete NGFW policies, security objects, and security profiles.

  • Search for security objects across devices using global search functionality.

  • Associate a policy group with a Catalyst SD-WAN NGFW policy.

Policy deployment to Secure Router devices

Changes that are made to NGFW policies, security objects, and security profiles in Security Cloud Control Firewall Management are automatically saved to Catalyst SD-WAN Manager. However, the updated configuration must be manually deployed to Secure Router devices using Catalyst SD-WAN Manager. These changes cannot be pushed directly to devices from Security Cloud Control Firewall Management.

View intrusion events

The Intrusion Prevention System (IPS) helps you detect and block network intrusions and malicious activities based on Cisco Talos threat intelligence.

The Top Intrusion & Malware Events dashlet in the Security Cloud Control Firewall Management dashboard is mapped to Intrusion Prevention and Advanced Malware Protection dashlets in the Monitor page of Catalyst SD-WAN Manager on the Security tab.

Procedure

Step 1

Click Dashboard.

Step 2

Navigate to the Top Intrusion & Malware Events dashlet.

Step 3

Click SDWAN under Data Sources.

Step 4

Click the Intrusion Events tab.

Step 5

Select Blocked in the drop-down near the dashlet.

By default, Allowed is selected.

Top Intrusion & Malware Events dashlet displaying the Intrusion Events tab with example intrusion data and selection options.

Step 6

Click the event you want to view in Catalyst SD-WAN Manager.

A cross-launch window of the Catalyst SD-WAN Manager Monitor page appears.

Step 7

Navigate to the Intrusion Prevention dashlet to view the event.

View malware events

The Advanced Malware Protection (AMP) events dashlet displays the counts of malicious, unknown, and clean files identified by AMP over a selected period. AMP blocks malware based on file reputation and uploads unknown files to Cisco AMP Threat Grid for further analysis.

The Top Intrusion & Malware Events dashlet on the Security Cloud Control Firewall Management dashboard is mapped to the Intrusion Prevention and Advanced Malware Protection dashlets on the Monitor page of Catalyst SD-WAN Manager on the Security tab.

Procedure

Step 1

Click Dashboard.

Step 2

Navigate to the Top Intrusion & Malware Events dashlet.

Step 3

Click SDWAN under Data Sources.

Step 4

Click the Malware Events tab.

Step 5

Select Blocked in the drop-down near the dashlet. By default, Allowed is selected.

Malware Events tab in the Top Intrusion & Malware Events dashlet displays malicious file counts over time.

Step 6

Click the event you want to view in Catalyst SD-WAN Manager.

A cross-launch window of the Catalyst SD-WAN Manager Monitor page appears.

Step 7

Navigate to the Advanced Malware Protection dashlet to view the event.