Post on 04-Jun-2018
Deploying Secure Branch & Edge Solutions
Session Level: Intermediate
Audience: Network & Security Professionals
At the End of this session you should understand:
• Security is an ongoing process and not a race to the finish
• Components of the Secure Branch
• How to leverage IWAN, Cloud and Virtualization Technologies to improve branch user experience
• How Security & IT can enable the business as well as mitigate risk
BRKSEC-2008 Session Objectives
Additional Related Sessions
• BRKCRS-3447 - Network Function Virtualization for Enterprise Networks
• BRKSEC-4054 - Advanced Concepts of DMVPN
• BRKRST-2309 - Introduction to WAN MACSec - Aligning Encryption Technologies with WAN Transport
• BRKNMS-1040 - IWAN and AVC Management with Cisco Prime Infrastructure
• BRKCRS-2000 - Intelligent WAN (IWAN) Architecture
• TECCRS-2004 - Implementing the Intelligent WAN (IWAN)
• BRKRST-2042 - Highly Available Wide Area Network Design
Additional Related Sessions
• BRKSEC-1030 - Introduction to the Cisco Sourcefire NGIPS
• BRKSEC-2028 - Deploying Next Generation Firewall with ASA and Firepower Services
• BRKSEC-2909 - Think Like an Attacker: Advanced Cloud Protection Against Web-Based Malware & Targeted Attacks
• DEVNET-1155 - Branch Virtualization
• BRKRST-2362 - Implementing Next Generation Performance Routing - PfRv3
• BRKARC-3001 - Cisco Integrated Services Router - Architectural Overview and Use Cases
• Session Objectives
• Security Strategy
• Network as a Visibility Tool
• Evolving the Branch
• Closing Remarks
Agenda
Digital Innovation Overwhelming the Branch80%
30%
20-50%BRANCH
OS
Updates
HD
Video
Omni-channel
Apps
Mobile
Apps
Online
Training
SaaS Enterprise
Apps
Social
Media
Guest
WiFi
Digital
Displays
MORE
USERS
MORE
APPS
MORE
THREATS
Of employee and
customers are served in
branch offices*
Increase in Enterprise
bandwidth per year
through 2018**
Of advanced threats will
target branch offices by
2016 (up from 5%) ***Tech Target, Branch Office Growth Demands New Devices., 2013
**Gartner, Forecast Analysis: Worldwide Enterprise Network Services, Q2 2014 Update
*** Gartner: “Bring Branch Office Network Security Up to the Enterprise Standard, Jeremy D’Hoinne, 26 April. 2013.
73%MORE
DEVICES Growth in in mobile
devices from 2014 - 2018**
Todays Cyber Threats
China PLA Russia Special
Communications Service
France DGSE/DCRI
Government related
hacktivist groups
British - GCHQUSA - NSA
many others…
Put aside rights, wrongs and politics of Snowden: the main point for Network and Information
Technologists is to recognize something significant: What Government Agencies have now, the
average Cyber Criminal will have available to them within 3-4 years*
*Bruce Schneier: NSA snooping tactics will be copied by criminals in 3 to 5 years
Dynamic Threat Landscape
100%of companies connect
to domains that host
malicious files or services
60%of data is
stolen in
hours
54%of breaches
remain undiscovered
for months
It is a Community
that hides in plain sight
avoids detection and
attacks swiftly
• Session Objectives
• Security Strategy
• Network as a Visibility Tool
• Evolving the Branch
• Closing Remarks
Agenda
Implications & Consequences
Loss of Intellectual Property
• Litigation Expenses
• Damage Control
• Compromise of Business plans and loss of revenue
Loss of Customer Data
• Public Perception, Sentiment, Reputation
• Liability
• Trust
• Brand Value
Where does Information Security sit in your network architecture development cycle?
They Are After The Data
• Personal Data
• Customer Information
• Intellectual Property
• Social Security Numbers
• Credit Card numbers
• Bank Account Information
• Healthcare & Employee Data
Your Data, Your Company’s Data, Everyone’s Data
Healthcare & Employee Data
• Social Security Numbers
• Names and Addresses
• Family History & Personal History
• Confidential Medical History
• Used to buy expensive Medical Equipment or Care
• Healthcare fraud takes longer to detect than other types of fraud
Hackers are Organized
• Survey
• Write
• Test
• Execute
• Steal & Sell Your Data
• Profit
For additional information check Cisco’s Annual Security Report
http://www.cisco.com/c/en/us/products/security/annual_security_report.html
Their Projects are to Breach Your Networks
The Threat-Centric Security Model
BEFOREDiscover
Enforce
Harden
AFTERScope
Contain
Remediate
Attack Continuum
Network Endpoint Mobile Virtual Cloud
Detect
Block
Defend
DURING
Point in Time Continuous
How do you address this Threat-Centric Security Model?
TrustSec
Encryption/VPN
Next Generation Firewalling
Next Generation IPS
Application Visibility & Control
Advanced Malware Protection
BEFOREDiscover
Enforce
Harden
AFTERScope
Contain
Remediate
Detect
Block
Defend
DURING
• Session Objectives
• Security Strategy
• Network as a Visibility Tool
• Evolving the Branch
• Closing Remarks
Agenda
• Application Visibility and Control
• TrustSec
• Next Generation IPS
Network Visibility Tools in the Branch
What is Application Visibility & Control?
• NBAR2
• Deep Packet Inspection
• Application Recognition
• Flexible Netflow (FNF)
• Netflow Version 9 or IPFIX
• Open Protocol so 3rd parties can leverage
• Flexible field exports – streamline your exports to maximize resources
• Application Performance Monitoring
• Traffic statistics
• Application response time
• URL collection
• Control
• QoS w/NBAR2
• Performance Routing (PfR)
FNF +
NBAR2
MAC
Source IP Address
Source Port
Destination Port
Gaining Full Visibility with Flexible Netflow
Flexible NetFlow & NBAR
Monitors data from layer 2 thru 7
Determines applications by combination of port and payload
Flow information who, what, when, where
Flexible NetFlow allows your own select of key fields
Protocol
Link Layer
Header
Deep Packet (Payload)Inspection
ToS
NetFlowDestination IP Address
IP Header
TCP/UDP
Header
Data
Packet
Key Fields Packet #1
Source IP 10.1.1.1
Destination IP 173.194.34.134
Source Port 20457
Destination Port 23
Layer 3 protocol 6
TOS byte 0
Ingres Interface Ethernet 0
Src. IP Dest. IP Src. Port Dest. Port Layer 3 Prot. TOS Byte Ingress Intf.
10.1.1.1 173.194.34.134. 20457 80 6 0 Ethernet 0
Key Fields Packet #2
Source IP 10.1.1.1
Destination IP 72.163.4.161
Source Port 30307
Destination Port 80
Layer 3 protocol 6
TOS byte 0
Ingres Interface Ethernet 0
Src. IP Dest. IP Src. PortDest.
PortLayer 3 Prot.
TOS
ByteIngress Intf. App Name
Timest
ampsBytes Packets
10.1.1.1 173.194.34.134 20457 80 6 0 Ethernet 0 HTTP
10.1.1.1 72.163.4.161 30307 80 6 0 Ethernet 0 Youtube
NetFlow cache
News
Flexible NetFlow - NBAR Integration
flow record app_record
match ipv4 source address
match ipv4 destination address
match …..
match application name
First packet of a flow will create the Flow entry using the Key Fields”
Remaining packets of this flow will only update statistics (bytes, counters, timestamps)
How Can Application Visibility Help me?
• Discovery
• Identify business critical applications and services and how they are used across the network
• Identify Indications of Compromise
• Define better network policies either for application support or security
• Use the data to be more precise in your segmentation efforts
• Network behavior anomaly detection
• Forensics data support
• Audit trails of all host to host communications across the network
Where does the ‘Control’ part come into play?
Performance Routing (PfR)
• Application routing based on real time performance information
• Load sharing to fully utilize available WAN resources
• Improve performance of critical applications
Quality of Service (QoS)
• Guarantee Bandwidth to protect critical applications
• Provide low latency to delay sensitive applications
• Stop or limit unwanted applications from using WAN resources
The ‘Traditional’ Control Part
Control from a Security Perspective
• Detect Anomalous Traffic
• Detect User Access Policy Violations
• Obtain Broad Visibility of Network Traffic
• Dynamic Segmentation to Contain Attacks
• Control Access to Critical Assets
• Do all this in a manageable and scaleable way
What do we need to accomplish our security goals?
• Application Visibility and Control
• TrustSec
• Next Generation IPS
Network Visibility Tools in the Branch
What is TrustSec?
• TrustSec is a systemic approach to policy control in your network.
• Who is connecting to it?
• What is connecting to it?
• Type of device, is it a user or non-user device?
• Where are they?
• Location information.
• When?
• Time based controls.
• How are they connecting?
• Wired or Wireless?
Traditional Controls & Access Policy
• Access Lists based on 5-Tuples
• Source IP address
• Source Port
• Destination IP address
• Destination Port
• Transport Protocol
• Policy Applied at Demarcation points
• Firewalls in the DMZ, Edge & Data Center
• Mobility users challenge traditional ACLs
• Internet of Everything
How do we take this complexity out?
The Usual Access Controls
• Static – usually manually maintained
• Difficult to maintain documentation
IP Address Based Access-lists
Context – A Set of Circumstances
• User authentication & role-based access
• Device Posture assessment
• Non-User devices profiling
• Guest access services
• Centralized policy management
• Distributed access policy enforcement
TrustSec builds and enforces centralized, identity based access policies
Simplified Access Management
• Control access by business role
• Uses plain language
• Accelerated Security Operations
Moves, adds & changes are simplified
• Automated FW & ACL administration
• Quicker deployment of servers
Consistent Policy Anywhere
• Enforces policy on wired, wireless & VPN
• Scales to remote, branch, campus & data center
TrustSec: Simplifying your Network Security Policy
Security Group ACL Enforcement PolicyS
ourc
e
Destination
Policy Representing
Source = Credit Card Scanner SGT
Destination=Credit Card Server
Policy = Deny IP
Campus to Data Center Access Control
Wired
Access
Wireless
Access
DC Firewall
Enterprise
Backbone
DC
Virtual
AccessCampus Core DC Core
DC
Distribution
Physical
Server
Source
Classification Propagation Enforcement
Destination
Classification
Physical
Server
VM
Server
VM
Server
DC
Physical
Access
End user authenticated
Classified as Employee
(5)
FIB Lookup
Destination MAC/Port SGT 20
Destination Classification
WEB: SGT 20
EMAIL: SGT 30
SGT 20
SGT 30
SRC\DST WEB (20) EMAIL (30)
Employee (5) SGACL-A SGACL-B
BYOD (7) Deny Deny
5SRC:10.1.10.220
DST: 10.1.100.52
SGT: 5
DST: 10.1.100.52
SGT: 20
DST: 10.1.200.100
SGT: 30
• Application Visibility and Control
• TrustSec
• Next Generation IPS
Network Visibility Tools in the Branch
What is Next Generation IPS?
• Must contain the functionality of 1st generation IPS
• Full stack visibility
• Application awareness
• Context awareness
• Content awareness
• Agile engine
Control
• AUTOMATE your control mechanisms
• ACT
• Enforce policy
• Detect and Block active compromise attempts
• REPORT
• Report on indications of compromise
• Provide forensics data (continuous and point in time)
• Provide an additional source for host to host communications records (second place to send netflow data)
FireSIGHT: More Contextual Awareness and Visibility
FireSIGHT Adds The Ability To:
• Get detailed contextual awareness including real time network analysis
• Obtain detailed information on host, OS, running applications, services hosted,
Host vulnerabilities, Geolocations, Users and many more
• Get a Network File trajectory that provides file path and information about point
of origin
• Session Objectives
• Security Strategy
• Network as a Visibility Tool
• Evolving the Branch
• Closing Remarks
Agenda
Evolving the Branch
• Technology Trends
• Leveraging Virtualization
• Prioritizing Critical Business Applications
• Connecting the Cloud
Improving the Secure Branch User Experience
Technology Trends in the Branch OfficeInfrastructure Centralization Improves IT Efficiency
Data Center/Cloud Branch Office
WAN/Internet
Mail ServersFile ServersWeb Servers
Voice Systems
Storage Security
Infrastructure
Simplified IT Operations, Higher Resource Use, Cost Savings
Limitations of Centralized Infrastructure Reliance on WAN Affects User Experience
Performance
WAN Speed Limitations
Latency
Bandwidth
Performance targets may require local processing
Availability
WAN Quality Limitations
Reliability
Congestion
Availability targets may require local survivability
Compliance
Off-Site Data Limitations
Privacy
Access
Compliance policies may require local presence
The Lean Branch OfficeBalancing IT Efficiency and User Experience
• No local servers
• Full reliance on WAN
• Simplicity, low cost
• No service guarantees
Serverless Branch
Data Center/
Cloud
WAN/Internet
Branch Office
Lean Branch
Data Center/
Cloud
WAN/Internet
Branch Office
• 4-5 local servers
• Full reliance on WAN except for mission-critical applications
• All servers local
• No reliance on WAN
• Complexity, high cost
• Service guarantees
Full-Service Branch
Data Center/
Cloud
WAN/Internet
Branch Office
Branch Challenges Need for Converged Branch IT
Reduce Branch Complexity
Management Complexity
Branch Footprint
OpEx, Power, Cooling
Business Agility
Increased Productivity
Lower Costs
Compute and Storage
Unified Communications
WAN Optimization
WAN Path Control
QoS
Application Visibility
Threat Defense
VPN Services
Network and Compute Performance for All Office SizesCisco ISR 4400/4300 Series
ISR 432150-100 Mbps
ISR 4331100-300 Mbps
ISR 4351 200-400 Mbps
ISR 4431 500-1000 Mbps
ISR 4451-X 1-2Gbps
WA
N A
ccess S
peed
Wit
h S
ervic
es
2911
1921 1941
2901
3945
150 Mb100 Mb75 Mb50 Mb35 Mb
EFMSubrateFE
VDSL2+/Sub-rate FE
Line Rate FE +
25 Mb
Line Rate N x FE
3945E
3925E
350 Mb
2921
2951
3925
800
15 Mb 250 Mb10 Mb
WAN Access Speeds with Services
Cisco ISR G2
Cisco UCS E-Series Single-Wide Blade Compact Blade Housed in Cisco ISR G2 and ISR 4000 Chassis – UCS-E140S M2
Up to 2 SATA, SAS, or SSD hard drives
Configuration and
management through CIMC
Intel® Xeon® E3 Family quad-core
processor
On-board hardware RAID 0/1 with hot-
swappable capability
One external and two
internal GE ports
USB 2.0 port for external
device connectivity
8, 12, and 16 GB
DRAM options
Maximum 65 W power draw
80 percent less than server
Wire-free, plug-and-play modularity,
low shipping weight (2.5 lb/1.1 kg)
Remote and
schedulable power
management
iSCSI initiator
hardware offload
KVM console connector
10/100 Ethernet
management port
Two SD cards: One for the CIMC
and temporary storage of OS and
one for a blank virtual drive
Cisco UCS E-Series Double-Wide BladeMultipurpose Blade Housed in ISR G2 and ISR 4000 Chassis – UCS-E160D/UCS-E180D
Up to 3 SATA, SAS, SSD hard drives or 2
HDD and a PCIe card
Out-of-band
configuration and
management through
CIMC
On-board hardware RAID 0, 1,
and 5 configuration options
with hot-swappable capabilityTwo external and two internal GE ports
with TCP/IP acceleration
Front-panel VGA, 2 USB, and serial
console connectors
8 GB – 96* GB
DRAM options
Maximum 130 W power draw,
80 percent less than server
Wire-free, plug-and-play modularity,
low shipping weight (7 lb / 3.2 kg)
Remote and
schedulable power
management
iSCSI initiator
hardware offload
Two SD Cards: one for the CIMC
and temporary storage of OS
and one for a blank virtual drive
Intel Xeon E5-2400 Quad
Core/Six-Core/Eight-Core
Processor
UCS E-Series Portfolio
Cisco UCS-E140S
• SKU: UCS-E140S-
M2/K9
• Cores: 4
• RAM: 8-16GB (2
DIMMs)
• HDD: 2 hard-drives,
available in 3 SSD,
SAS and SATA
options
Cisco UCS-E180D
Cisco UCS-E160D
• SKU: UCS-E160D-
M2/K9
• Cores: 6
• RAM: 8-48GB (3
DIMMs)
• HDD: 3 hard-drives,
available in SSD,
SAS and SATA
options
• SKU: UCS-E180D-
M2/K9
• Cores: 8
• RAM: 8-48GB (3
DIMMs)
• HDD: 3 hard-drives,
available in SSD,
SAS and SATA
options
• SKU: UCS-EN120S-
M2/K9
• Cores: 2
• RAM: 4-16GB (2
DIMMs)
• HDD: 2 hard-drives,
available in 2 SAS
and SATA options
Cisco UCS-EN120S
Cisco UCS-EN120E
• SKU: UCS-EN120E
• Cores: 2
• RAM: 4-8GB (1DIMM)
• HDD: up to 200GB SSD
Storage
Cisco UCS E-Series Server Hypervisor and OS Support
VMware Hypervisor
• VMware vSphere Hypervisor™ 5.0.1
• VMware vSphere Hypervisor™ 5.1
• VMware vSphere Hypervisor™ 5.5
Other Hypervisors
• Hyper-V (Windows 2008 R2, 2012 R2)
• Citrix XenServer 6.0
Microsoft Windows
• Windows Server 2008 R2 Standard 64-bit
• Windows Server 2008 R2 Enterprise 64-bit
• Windows Server 2012, 2012 R2
Linux
• Red Hat Enterprise Linux 6.2
• SUSE Linux Enterprise 11, service pack 2
• Oracle Enterprise Linux 6.0, update 2
Supported by Cisco SMARTnet
Attached to ISR
Supported by OS / Hypervisor Vendor
Purchased separately
ISR Chassis
Cisco® UCS E-Series Server Module
Hypervisor
Hardware Support
Provided by Cisco®
UCS E-Series hardware
supported under ISR
SMARTnet at no
additional cost
VMware Embedded
Software - ESX and
Foundation supported
by ISR SMARTnet
Cisco ISR 4451-X Converged Branch Infrastructure Solution
Technology Consolidation for Branch Services Unified
Communications
Server Blades with Storage
Security
WAN Optimization Mobility
Routing
Management Interface
Connects control plane directly to
a management network.
Front Panel GE
• 4 RJ45/SFP GE Interfaces
• PoE available on 2 Interfaces
Network Interface Modules (NIM)
• Larger & more powerful than EHWICs
• Up to 8 ports per module
• DSPs directly on modules
Optional Drive NIM for Embedded
Applications
• RAID 1 for data protection
• Single HD (future) &
Dual SSD Options
Extended Service Modules
• Compatible with ISR G2
• Up to 10Gb connection to system
• Faster & more powerful than SMs
SM-X Layer2/3 EtherSwitch® Service Module(SM-X)
• Capable of PoE+ (30W), MACSec and Cisco
TrustSec
• Simplified Licensing for upgrade to Layer-3 features
Enable Advanced Threat Protection Across Branches
HIGH
PERFORMANCE VPN
ADVANCED THREAT
DEFENSECLOUD WEB
SECURITY
CONSISTENT POLICY
ENFORCEMENT
DMVPN, GET VPN,
Flex VPN
• Up to 1.3 Gbps encryption
• Advanced encryption
(Suite B)
• Integrated crypo without
additional hardware
FirePOWER IPS & IDS
• Industry leading network
intrusion detection &
prevention
• Integrated on UCS E-
Series blades
CWS with Advanced
Malware Protection
• Real-time web filtering with
AVC
• Threat analytics for full
continuum: Before, During,
After
TrustSec with Identity
Service Engine
• Single Source for Policy
Rules
• Context Aware
• 80% reduction in rules and
policy
VPN
FireSIGHT
HQ
Cisco FirePOWER Threat Defense for ISRCentralized Policy Distributed enforcement
Branch
Office
Branch
Office
Branch
Office
Cisco Cloud Intelligent NetworkDelivering Optimal Experience, Pervasive Security, and Simplified Operations
Branch Private/Public/Hybrid
3rd PartyWebSecurity
Cloud
Storage
Collaboration
Survivability
Cloud Connectors
Cloud-Ready Network Services
Visibility Optimization CollaborationApp
HostingSecurity
Cloud-Ready Platforms
OS
Campus / Data Center
Cloud
ISR G2 ASR 1K CSR 1KV
Branch Office
Management and Policy
Server
Hypervisor
Virtual Switch
VPC/ vDC
OS
App
OS
App
CSR 1000V
RP
FP
CSR 1000V - Cloud Ready Router• IOS-XE code base
• Comprehensive feature set
• Infrastructure Agnostic
• Cisco UCS, Dell, HP, etc. - Intel and AMD processors supported
• Runs on vSwitch, dVS, N1KV, etc..
• VMware ESXi 5.1, Citrix Xen Server 6.1, KVM – RHEL 6.3, RHEV 3.1 supported
• Amazon AMI support
• Footprint
• 4 vCPU, 2 vCPU, 1vCPU supported. Note: 2 physical cores * 2 = 4 vCPU with Hyperthreading
• 2.5 GB/1vCPU [default] , 4 GB/4vCPU
• 8 GB HD – Local, SAN, NAS supported
Enterprise
A
Single-Tenant Gateway in the CloudCan be deployed by Enterprises or Cloud Providers
AS
R
Branch
ISR
Current Use Cases MPLS CE Router (vCE)
Network Services – VPN
Gateway, Control Point
Hybrid Cloud Connectivity - L2/
L3 Extension
Potential Use Cases MPLS PE Router (vPE)
Control Plane Function – Route
Reflector
Military Apps – MANET/ Radio-
aware Routing
Enterprise
BBranch
ISR
Data
Center
CSR
1000V
CSR
1000V
Data Center
WAN
Router
Cloud Provider
Additional Information & Reference Materials
• Try it for yourself – go to dCloud – http://dcloud.cisco.com
• FirePOWER Labs
• TrustSec Labs
• IWAN Labs
• Lancope Labs
• Much more…
• User your CCO account to gain access
• Next Generation Cryptography: http://www.cisco.com/web/about/security/intelligence/nextgen_crypto.html
• Cisco’s Annual Security report
http://www.cisco.com/c/en/us/products/security/annual_security_report.html
• Session Objectives
• Security Strategy
• Network as a Visibility Tool
• Evolving the Branch
• Closing Remarks
Agenda
Participate in the “My Favorite Speaker” Contest
• Promote your favorite speaker through Twitter and you could win $200 of Cisco Press products (@CiscoPress)
• Send a tweet and include
• Your favorite speaker’s Twitter handle - @CCIE42683
• Two hashtags: #CLUS #MyFavoriteSpeaker
• You can submit an entry for more than one of your “favorite” speakers
• Don’t forget to follow @CiscoLive and @CiscoPress
• View the official rules at http://bit.ly/CLUSwin
Promote Your Favorite Speaker and You Could Be a Winner
Complete Your Online Session Evaluation
Don’t forget: Cisco Live sessions will be available for viewing on-demand after the event at CiscoLive.com/Online
• Give us your feedback to be entered into a Daily Survey Drawing. A daily winner will receive a $750 Amazon gift card.
• Complete your session surveys though the Cisco Live mobile app or your computer on Cisco Live Connect.
Continue Your Education
• Demos in the Cisco campus
• Walk-in Self-Paced Labs
• Table Topics
• Meet the Engineer 1:1 meetings
• Related sessions
• Threat Defense Demo in The Hub – Live traffic from the show’s Internet connection
• Whisper Suites - Cisco FirePOWER Threat Defense for ISR