Cisco FMC/FTD useful flex configs

See anyconnect usernames in the log (good for brute force attackes) 

Once / Append

no loggin hide username

Disable CSD (related to AnyConnect posture)

Every time / Append

tunnel-group DefaultWEBVPNGroup webvpn-attributes

without-csd

VPN idle policy

Once / Append

group-policy .DefaultS2SGroupPolicy attributes

vpn-idle-timeout none

vpn-session-timeout none

Control plane ACL

Once / Append

access-group $Anyconnect_Block_Bad in interface OUTSIDE control-plane

Enable threat detection

Every time / Append

threat-detection service invalid-vpn-access

threat-detection service remote-access-client-initiations hold-down 10 threshold 20

threat-detection service remote-access-authentication hold-down 10 threshold 20

Disable AnyConnect webpage

Once / Append

webvpn

keepout "503: Service Unavailable"

Enable  AnyConnect webpage

Once / Append

webvpn

no keepout "503 Service Unavailable"

activate trial license on palo alto firewall

Log into https://support.paloaltonetworks.com/

Go into Products > Assets

Find your firewalls by serial

Click the edit asset (pencil icon) on the right

Go to Licenses & Subscriptions at the top

Review in case there are any licenses there waiting to be activated (activate those if the real purchased licenses are there)

If they are not appearing and we need them in a rush, we can try apply a temp license

Click "activate License" button at the bottom

Choose activate trial license

Tick the box for the licenses we need

Agree and Submit

fixing cisco umbrella AD connector issues

Some AD connectors were in a state of error

The customer had not actioned the API key and AD username updates.

Step 1 - Fix the API key as per cisco's instructions

Make sure to save your secrets in a pw fault

https://www.cisco.com/c/en/us/support/docs/security/umbrella/225982-configure-and-verify-new-authentication.html

Step 2 - Confirm password for opendns_connector user, now cisco_connector

Testing pw cmd:

• runas /netonly /user:OpenDNS_Connector@domain.int notepad.exe

Testing pw powershell:

Add-Type -AssemblyName System.DirectoryServices.AccountManagement

$ctx = New-Object System.DirectoryServices.AccountManagement.PrincipalContext('Domain','domain.int')

$ctx.ValidateCredentials('OpenDNS_Connector', (Read-Host 'Password'))

Update the username in AD to Cisco_Connector

Reset the password if needed

Step 3 - Download latest connector installer and script from umbrella dashboard 

Step 4 - Uninstall connector, run script, re-install connector

Uninstall old connector

Run AD script 

Install connector, choose AD

Enter the Cisco_Connector password we updated above

Step 5 - Check logs and wait for cloud sync (15 min)

Check logs in

C:\Program Files (x86)\Cisco\CiscoADConnector\v1.x.x

CiscoAuditClient

2026-10-02 10:34:01.522: Bearer token request Successful

2026-10-02 10:34:01.522: GetBearerToken() Success: 200

CiscoAuditClient.error

Check for errors

Hard refresh the umbrella dashboard ctrl + F5.

If sync issues are not resolve gather logs and raise case with cisco TAC

palo alto updates quirk

Sometimes to get the updates to load 

Go to

dynamic updates

check now

software untick all boxes

check now

now look for version eg 11.2.10

click download

If its still not showing check firewall rules allow management IP's to access paloalto updates

investigate failover on palo alto firewall

 Log into both firewalls

In the Dashboard > High Availability widget, you may notice the primary has change from active to passive.

On both firewalls go to 

• Monitor > System
• Filter the log 
• subtype eq ha

You should see a reason for the failover. 

Often the link monitors fail (internet connection issue). You can check them here

• Device > High Availability > Link and Path Monitoring 
• Link group will show the interfaces that need to be up (Layer 2)
• Path group will show the IP's the firewall will try to ping to confirm link is up (Layer 3)

 Have seen the auto updates trigger failovers as well

palo alto nat across S2S VPN to reach mgmt interface

Customer had 192.168.x.x network overlapping

I needed to reach 192.168.0.82

I decided to NAT on customer side.

I sent traffic to 172.17.19.0 (This was in the VPN proxy ID)

172.17.19.0 (cust side) <> 172.16.100.0 (my side)

Now for NAT

Source Zone: VPN-ZONE (don't forget tunnel interface setup)

Destination zone: LAN

Source add: 172.16.100.0

Destination add: 172.17.19.0

Translated packet

Destination address translation

Translation type: Static IP

Translated address: N-192.168.0.0-24

Also note that mgmt interface IP config is not sync'd so you will need to get your IP's allowed under 

device > setup > interfaces > management > permitted IP addresses 

switch meraki mx to new internet connection

*** Important 

Cisco messed up the local status page passwords. Autogenerated pws but they weren't stored by cisco or given to customers.

Step 1 - Make sure local status page is enabled and pw reset

• Network wide > configure > general 
• Scroll down to Device configuration
• Make sure "local device status page enabled" is selected in the drop down
• Change password, enter a 14 char pw with numbers/upper and lower case and symbol
• Click update
• Allow time for cloud to sync

Step 2 - Test local status page before switching

• Before switching anything 
• Plug laptop into a meraki LAN port (check the port is on right vlan)
• Visit the local status page for MX it should be http://wired.meraki.com
• One customer said it only worked in edge but not chrome 
• test login works

Step 3 - Switch over to new interconnection and reconfig

• Switch over to new internet connection
• Plug WAN port into the new ISP
• Log into local status page. 
• Config the new settings and save
• Give it a few minutes to connect to cloud (check LEDs)
• It should come online and appear in cloud
• You may also change the cloud config to match 

Meraki status pages

MR - http://ap.meraki.com

MS - http://switch.meraki.com 

MX - http://mx.meraki.com or http://wired.meraki.com

MG - http://mg.meraki.com

Any - http://setup.meraki.com or http://my.meraki.com

FYI - Cisco reset local status page passwords, it used to be admin and the serial of the device but in 2025 cisco auto generated one and asked users to set a password.

https://documentation.meraki.com/General_Administration/Tools_and_Troubleshooting/Using_the_Cisco_Meraki_Device_Local_Status_Page

policy based routing (PBR)

I was working on an issue with something not working related to PBR.

A good rule of thumb is do the PBR's on outbound traffic. Next the next hop IP to outside gateway or LAN switch

Let NAT's handle inbound traffic

Outbound

LAN1 > LAN2

LAN1 > Outside > NAT > Internet

Inbound

Internet traffic > Outside > NAT > LAN1

cisco duo authproxy using ldaps cert expired

The DC certs were renewed. The CA that signed them had also been renewed. The ssl_ca_certs_file in authproxy.cfg was now pointing to an old/incorrect CA certificate that no longer matched. This caused the SSL verification to fail and preventing users from logging in.

From the authproxy server. Run this power shell. You'lls need to update the name of DC1.domain.local to match your DC

$tcpClient = New-Object System.Net.Sockets.TcpClient("DC1.domain.local", 636)

$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream(), $false, {$true})

$sslStream.AuthenticateAsClient("DC1.domain.local")

$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain

$chain.Build($sslStream.RemoteCertificate)

$chain.ChainElements | ForEach-Object {

    $c = $_.Certificate

    Write-Host "Subject: $($c.Subject)"

    Write-Host "Thumbprint: $($c.Thumbprint)"

    Write-Host "---"

}

This should let us know the new thumbprint

Now we can use it to export the certs we need 

$tcpClient = New-Object System.Net.Sockets.TcpClient("DC1.domain.local", 636)

$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream(), $false, {$true})

$sslStream.AuthenticateAsClient("DC1.domain.local")

$chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain

$chain.Build($sslStream.RemoteCertificate)

$caCert = $chain.ChainElements | Where-Object { $_.Certificate.Thumbprint -eq "NEW-CA-THUMBPRINT-HERE" } | Select-Object -First 1

$bytes = $caCert.Certificate.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert)

$b64 = [System.Convert]::ToBase64String($bytes, [System.Base64FormattingOptions]::InsertLineBreaks)

$pem = "-----BEGIN CERTIFICATE-----`n$b64`n-----END CERTIFICATE-----"

[System.IO.File]::WriteAllText("C:\certs\DC-CA-new.cer", $pem)

Write-Host "Done - saved to C:\certs\DC-CA-new.cer"

Update authproxy.cfg file

under [ad_client] section

ssl_ca_certs_file=C:\certs\DC-CA-new.cer

Stop/start the authproxy service

net stop DuoAuthProxy && net start DuoAuthProxy

run connection tool again all should be fixed:
C:\Program Files\Duo Security Authentication Proxy\bin> .\authproxy_connectivity_tool.exe

google cyber sec cert notes

CIA triad 

• Confidentiality (least privilege / zero trust)
• Integrity ( data is correct and reliable, can't be edit, encryption )
• Availability ( data can be used when needed )

CISSP

Certified Information Systems Security Professional

CISSP 8 security domains

• Security and Risk Management: The foundational domain covering governance, compliance, the CIA triad (Confidentiality, Integrity, Availability), legal/regulatory issues, and organizational risk assessment
• Asset Security: Focuses on the protection of assets, data classification, handling requirements, data retention policies, and data lifecycle management
• Security Architecture and Engineering: Encompasses security models, cryptography, hardware/software design, and mitigating vulnerabilities within system architectures
• Communication and Network Security: Deals with secure network design, hardware, transmission methods, and securing communication channels (e.g., VPNs, firewalls)
• Identity and Access Management (IAM): Centers on controlling access to systems and data, covering authentication, authorization, and identity provisioning
• Security Assessment and Testing: Focuses on security testing methodologies, vulnerability assessments, penetration testing, and auditing to evaluate security controls.
• Security Operations: Covers daily operational tasks such as incident management, disaster recovery, patch management, and foundational forensic
• Software Development Security: Applies security controls and coding principles within the Software Development Life Cycle (SDLC) and databases.

Asset 

• A item that has value to an organisation

Threat

• Anything that can negatively impact assets  

Risk

• The likelihood of a threat occurring. We can also take into account low/high risk assets.
• 
  

Vulnerability 

A weakness that can be exploited by a threat. There must be a vuln and a threat for there to be a risk

vuln + threat = risk

Risk management framework

• Prepare 
• Categorize
• Select
• Implement
• Assess
• Authorize
• Monitor

What to do about risk:

• Acceptance: Accepting a risk to avoid disrupting business continuity

• Avoidance: Creating a plan to avoid the risk altogether

• Transference: Transferring risk to a third party to manage

• Mitigation: Lessening the impact of a known risk

NIST RMF terms

• Assess: The fifth step of the NIST RMF that means to determine if established controls are implemented correctly
• Authorize: The sixth step of the NIST RMF that refers to being accountable for the security and privacy risks that may exist in an organization
• Business continuity: An organization's ability to maintain their everyday productivity by establishing risk disaster recovery plans
• Categorize: The second step of the NIST RMF that is used to develop risk management processes and tasks
• External threat: Anything outside the organization that has the potential to harm organizational assets
• Implement: The fourth step of the NIST RMF that means to implement security and privacy plans for an organization
• Internal threat: A current or former employee, external vendor, or trusted partner who poses a security risk
• Monitor: The seventh step of the NIST RMF that means be aware of how systems are operating
• Prepare: The first step of the NIST RMF related to activities that are necessary to manage security and privacy risks before a breach occurs
• Ransomware: A malicious attack where threat actors encrypt an organization’s data and demand payment to restore access 
• Risk: Anything that can impact the confidentiality, integrity, or availability of an asset
• Risk mitigation: The process of having the right procedures and rules in place to quickly reduce the impact of a risk like a breach
• Security posture: An organization’s ability to manage its defense of critical assets and data and react to change
• Select: The third step of the NIST RMF that means to choose, customize, and capture documentation of the controls that protect an organization
• Shared responsibility: The idea that all individuals within an organization take an active role in lowering risk and maintaining both physical and virtual security
• Social engineering: A manipulation technique that exploits human error to gain private information, access, or valuables 
• Vulnerability: A weakness that can be exploited by a threat

Frameworks

Guidelines to build plans

NIST frameworks (CSF)

• Govern - strong management of cyber sec risk across the whole org
• Identify - Knowing what's in your network from assests to policies
• Protect - Secure systems like adding firewall rules or removing malware
• Detect - watching logs to detect issues or issues logged by ticket
• Respond - respond to an incident 
• Recover - restore files from backups

OWASP

• Open
• Web
• Application
• Security 
• Principles 

Minimize attack surface

Least privilege / zero trust

Defence in depth, multiple lines of defence. MFA / segregation

Separation of duties. Eg windows admins / network admins / backup admins. No one has full control of the org. We can also look at it like having 3 team members if one gets sick the team is still up

Keep security as simple as possible (

Fix security issues, do root cause analysis and fix for good.

Keeping up to date

Medium

Conferences local and the big ones

Security audit 

External and internal 

Most will be done internal 

We will review and improve se

identify risk

check controls 

assess compliance 

Security controls

• admin controls - policies
• technical controls - IPS systems
• physical controls - cctv / locks

If we opeerate in the EU and take CC payment then we need to comply with GDPR and PCIDSS.

Log analysis

• 
  
• Firewall logs - connections / actions / traffic passing through the firewall
• Network logs - Taken from the switches in side getting that east > west traffic
• Server / endpoint logs - User login's / process / etc

SIEM

• Security 
• Information 
• Event 
• Management 

The SIEM takes in all the logs from multiple sources. It will create dashboards / graphs / timelines etc. 

SOAR

• Security
• Orchestration
• Automation,
• And Response 

SIEM types

Self hosted - you have your own server and data storage

Cloud hosted - cloud hosted by your vendor

hybrid - 

Splunk / splunk enterprise - cisco purchased it

Chronical - googles cloud native tool 

• Chronicle: A cloud-native tool designed to retain, analyze, and search data

• Incident response: An organization’s quick attempt to identify an attack, contain the damage, and correct the effects of a security breach

• Log: A record of events that occur within an organization’s systems 

• Metrics: Key technical attributes such as response time, availability, and failure rate, which are used to assess the performance of a software application

• Operating system (OS): The interface between computer hardware and the user

• Playbook: A manual that provides details about any operational action

• Security information and event management (SIEM): An application that collects and analyzes log data to monitor critical activities in an organization

• Security orchestration, automation, and response (SOAR): A collection of applications, tools, and workflows that use automation to respond to security events

• SIEM tools: A software platform that collects, analyzes, and correlates security data from various sources across your IT infrastructure that helps identify and respond to security threats in real-time, investigate security incidents, and comply with security regulations

• Splunk Cloud: A cloud-hosted tool used to collect, search, and monitor log data

• Splunk Enterprise: A self-hosted tool used to retain, analyze, and search an organization's log data to provide security information and alerts in real-time

Playbooks

• SIEM detects events
• Playbooks provide a guide for all staff to follow for each kind of incident
• Playbooks are living documents so they are updated all the time
• We have an incident, we apply the playbook, we review and update with lessons learned .

Networks and security

Before we can secure networks we need to understand how they work

MAC addresses (layer 2 local vlan)

IP's (layer 3 routing to other networks)

LAN small area (small business or home network)

WAN larger area (the internet is one big WAN)

• Hub - just retransmits signals broadcast all traffic everywhere not really used these days as they can cause loops. They are generally cheaper devices and often need to be rebooted regularly.
• layer 2 switch - more intelligent than a hub, has vlans and only sends traffic where it needs to go.
• router - connects multiple networks together
• layer 3 switch - switch and router combined. Many modern devices can do both for example a palo alto firewall can do switching on its ports, routing and firewalling.
• Home ISP device - Often a all in one small device that can do modem/routing/wifi/switching/basic firewalling. This lets home users connect to the ISP network and onto the internet.
• virtual network devices - virtual instances of network devices, we can bring up a virtual firewall in AWS for example 

Example traffic flow for small business

User device > switch > firewall  > internet > internet routers > destination

Example traffic flow for home connection

User device > WIFI > ISP modem/router > internet > internet routers > destination

Client/Server model

End user devices like computers / laptops / phones are known as clients

Servers are the servers hosting the service s that the clients want to use.

Cloud networks

Instead of having all the network devices and servers on site, companies can move their servers and network devices into the cloud and pay a cloud service provider (CSP).

Some benefits include on demand storage and processing power scaling. Cloud analytics (very useful for ops and security teams)

Software as a service (SaaS) - web applicaitons 

Infrastructure as a service (IaaS) - network and server infra

Platform as a service (PasS) - The development platform for the web apps

Just like normal infrastrucre, everything sits on top of the network and servers. None of the apps etc can work unless the infrastructure is working.

Iaas > Paas > SaaS

Data packet

Basic unit of information that travels from one device to another over the network

Basic form of a data packet

header body footer

On most networks data is transferred mostly via TCP/IP 

TCP/IP model

• 1 - Network access layer (ethernet / WIFI)
• 2 - Internet layer (IPv4 / IPv6)
• 3 - Transport layer (TCP / UDP)
• 4 - Application layer (HTTP TLS FTP SMTP etc)

ICMP 

Ping is the best and worst testing tool. ICMP used by ping is its own protocol. It's useful to testing basic network connectivity but it doesn't follow the same rules as TCP. For example you ping to a site can work but the website may not load because of an application layer issue.

TCP vs UDP

TCP - connections (SYN / SYN-ACK / ACK)

UDP - connectionless (used for voice/video streaming) QUIC MASQUE

OSI model 

• Application (HTTP, SMTP etc)
• Presentation (data translation / encryption / compression TLS)
• Session (Session manages open/active connections / reconnection them etc)
• Transport (transport, breaking up data into packets TCP/UDP)
• Network (get frames from data link and send them where to do, routing)
• Data link (macs and frames, NCP HDLC SDLC)
• Physical (cables etc)

TCP/IP model is real world. OSI is more theoretical. Need to be familiar with both.

IPv4 address

19.117.63.126

IPv6 address (32 characters)

684D:111:222:3333:444:555:6:77

All IPv4 addresses were being used up. We had to make IPv6 so there would be enough addresses for ever. So far it seems to have been adopted by service providers. I've not seen IPv6 on the LAN in most orgs. IPv6 addresses are much harder for humans to read and spot in logs.

Types of addresses:

• Public IP - on the internet
• Private IP - On the LAN
• MAC address - hardware address of the network card

Format of IPv4 packet

header 20-60

total 20 - 65535 bytes

• Version (VER): This 4 bit component tells receiving devices what protocol the packet is using. The packet used in the illustration above is an IPv4 packet.
• IP Header Length (HLEN or IHL): HLEN is the packet’s header length. This value indicates where the packet header ends and the data segment begins. 
• Type of Service (ToS): Routers prioritize packets for delivery to maintain quality of service on the network. The ToS field provides the router with this information.
• Total Length: This field communicates the total length of the entire IP packet, including the header and data. The maximum size of an IPv4 packet is 65,535 bytes.
• Identification: IPv4 packets can be up to 65, 535 bytes, but most networks have a smaller limit. In these cases, the packets are divided, or fragmented, into smaller IP packets. The identification field provides a unique identifier for all the fragments of the original IP packet so that they can be reassembled once they reach their destination.
• Flags: This field provides the routing device with more information about whether the original packet has been fragmented and if there are more fragments in transit.
• Fragmentation Offset: The fragment offset field tells routing devices where in the original packet the fragment belongs.
• Time to Live (TTL): TTL prevents data packets from being forwarded by routers indefinitely. It contains a counter that is set by the source. The counter is decremented by one as it passes through each router along its path. When the TTL counter reaches zero, the router currently holding the packet will discard the packet and return an ICMP Time Exceeded error message to the sender. 
• Protocol: The protocol field tells the receiving device which protocol will be used for the data portion of the packet.
• Header Checksum: The header checksum field contains a checksum that can be used to detect corruption of the IP header in transit. Corrupted packets are discarded.
• Source IP Address: The source IP address is the IPv4 address of the sending device.
• Destination IP Address: The destination IP address is the IPv4 address of the destination device.
• Options: The options field allows for security options to be applied to the packet if the HLEN value is greater than five. The field communicates these options to the routing devices.

Network protocols

A sample flow of a basic connection to a website.

• DNS - lookup IP to domain name www.website.com
• ARP - Find where next hope gateway is towards internet
• TCP - Make a connection to the website IP
• TLS - Setup secure connection between client and server
• HTTPS - Display the webpage in the browser over the TLS connection 

WIFI security

IEEE 802.11 is WIFI

WEP (broken) > WPA (transitional) > WPA2 (KRACK attacks still work) > WPA3 (more secure, more complex)

Firewalls

Allow/block traffic based on their rules. The rules are configured by admin.

• Hardware - physical device has its own memory/CPU
• Software - Software imagine which can run in your virtualization infra
• Cloud - Cloud hosted software firewall

stateless - Just applies its rules to traffic but doesn't keep track of connections (less secure

stateful - keeps track of connections and filters threats

ngfw - Does everything stateful does and more (DPI, IPS, Threat intel, content filtering etc)

Firewalls are often the headend for dial in VPNs (remote access for users)

VPNs (virtual private networks)

• Site links are expensive, we can make VPN across the public internet but keep them secure 
• S2S VPNs - connect two sites via an encrypted tunnel
• dial in or RA VPNS - remote access VPNs for end users to work from home etc

Security Zones

Before we had interfaces

Now we can have zones where we have multiple interfaces in one zone

Zones are used as part of network segmentation

Outside/internet - uncontroller

Ideally

Internet > firewall > DMZ > firewall > LAN > firewall > Restricted zone

We can have multiple DMZ's / LANs / WIFIs / Restricted zones

Often to cut costs we will just have one firewall with each zone as an interface off the firewall

Internet > firewall > DMZ/LAN/WIFI/Restricted

The firewall controls access between the zones.

To do some network segmentaiton

• Firewall interface (with firewall rules applied)
• Assign it to the inside security zone 
• Attach interface to the LAN vlan on the switch
• Create an IP subnet for the LAN network

Proxy servers

The proxy server forwards requests on.

The most common was a web proxy or forward proxy.

user > web proxy > internet

Users never get direct internet access.

Reverse proxy (often socks5) take data from internet/dmz and forwards it to inside servers.

forward: user > proxy > internet

reverse: internet/dmz > proxy > server

Many left behind forward proxies for cisco umbrella / dns protection.

VPN protocols

Wireguard

• code base: 4K lines
• cryptography: fixed modern suite
• High speed vpn
• newer (2016)
• open source
• key-pairs but not built in identity system

IPsec (IKEV2)

• code base: 10K plus
• Earlier protocol (late 1990s)
• More complex
• cryptography: Negotiable, many cipher/algorithm
• Tried and tested, well supported

 

TLS/DTLS-based VPNs (OpenVPN, Cisco AnyConnect/DTLS, GlobalProtect)

• code base: 10K plus
• In the middle protocol (openvpn 2001, dtls 2006)
• More complex
• cryptography: Negotiable, many cipher/algorithm
• Tried and tested, well supported

Rule-of-thumb selection guidance

• Need it to work everywhere, even hostile networks > TLS/DTLS (OpenVPN-style)
• Need broad native client support with enterprise auth (RADIUS/certs/MFA) > IPsec/IKEv2
• Need maximum speed/efficiency and control both ends > WireGuard (often paired with an identity/ACL layer like Tailscale for enterprise use)

Security hardening

Just like our house we don't leave doors and windows opens, we might use CCTV cameras and have a house alarm.

In IT we patch/update our systems. We require passwords/MFA to get access, we encrypt data in transit. We monitor logs for suspicious activity

OS hardening

• OS updates/patches
• Application updates/patches
• Library, some applications make use of common public librarys/packages, usually covered by updating the application but not always
• Password policies and MFA
• Baseline config

Brute force attacks - trying every combination of password

Dictionary attacks - trying password lists of credentials from previous breachs

Rainbow table attack - If we have a hash of the users password we can see if the hash has been cracked already to the plain text password.

Hashing

We take a plain text "password" and hash it with give a string. It's a one way password > hash. Then we can store the hash in our database instead of the users password.

Salting

Involves adding salt to the dish. hash = H(password + salt).

The salt is the stored alongside the hash (it doesn't need to be secret).

Rainbow table attacks: Attackers precompute huge tables of hash values for common passwords. If your hash matches an entry, they instantly know the password. Salting defeats this because each password now hashes differently even if the underlying password is the same — a precomputed table would need to account for every possible salt, making the attack impractical.

Duplicate detection: Without salts, two users with the same password get the same hash — visibly revealing that they share a password. Salts make each hash unique even for identical passwords.

Network hardening

• Updating software on network devices
• Using a firewall/ACLs to control access
• Port filtering
• network segmentation
• use latest encryption 
• network log analysis
• IPS/IDS

Network security in the cloud

Cloud security we should use baseline OS images

You can think about cloud security like living in a house alone. You might leave everything unlocked because its just you there. However if you have roommates you might start locking your room. When you are in a public cloud you are in there with roommates. Then cloud vendor and other customers.

Keep in mind with cloud some aspects will be hidden to you. With on prem you would have access to everything.

CSP secures the cloud infra and OS patches etc.

hypervisor type1: run on hardware

hypervisor type2: software

security holes in hypervisor can lead to VM escapes.

Baselining all security settings

encryption on data in flow and at rest

TPM: chip in computer to store private keys

CLoudHSM: cloud hardware security module

Security groups are groups in cloud that limit exposre of N/S and E/W traffic.

BIOS chips boot the computer

UEFI chips replaced BIOS chips on modern computers

BIOS/UEFI chips have a list of checks to boot the computer hardware

The last instruction activates the bootloader.

Bootloader is a software program that boots the OS

Once the OS boots the user can interface with the computer/applications

There are many attacks on operating systems but keep in mind there are attacks on chips and bootloaders too.

The OS is like a conductor allocating resources when and where needed.

The computer has limited resources but lots of applications asking for memory/CPU/disk access

GUI vs CLI

Often you will need to work on CLI in linux in IT security 

GUI: Icons and text

CLI: text based and commands

Using CLI is usually faster when you know what to do

history file is recorded so you can see what you have used

you may look at history file in a security incident

Linux in security 

linux is open source

gnu public license so they can be used and improved

global group of people working on code

FSH - file system hierarchy 

almalinux replaced centos

Package managers

apt and yum for installing applicaton

Types of shells 

bourne again shell (bash)

c shell (csh)

korn shell (ksh)

enchanced c shell (tcsh)

z shell (zsh)

bash is default for most distros

standard input (info you input into the shell)

String data

echo hello

standard output

the computers response on the cli

standard error

any errors the computer needs to output

Linux shell

You will need to work with log files and set permissions via the cli

Bash shell is the default for most distros and often all that is available on older systems

• cat - output the full file
• more - output the file but paged
• head -n 5 - see the top of the file
• tail -n 5 - see the end of the file

The root directory is always at the top and its /

• /home - user directories 
• /bin - binary executables (programs)
• /etc - config files
• /tmp - temp files
• /mnt - mounted media stores like USB drives or network shares

use the command "man heir" to learn more 

Grep

grep OS updates.txt

We are looking for "OS" in the updates.txt file

Pipe |

Sends the output of one command to another command

ls /home | grep users

Filtering for certain information is important for cyber sec professionals

Fin search for directories and files and meet a criteria

find /home/analyst/projects

-name is case sensitive

-iname is not case sensitive

find /projects/ -iname log

-mtime 3 all files that have been modified in the last 3 days

-mtrime +1 all files modified more than 1 day ago

Deleting directory

rmdir oldreports

Deleting file 

rm file.txt

delete a directory and everything under it

rm -rf oldproject

File editors

Nano is good for beginners

vi or vim is often on older systems, neovim is a newer version

emacs is also popular older editor

File permissions 

Get more details on the files in the directory

ls -l

ls -lash

We will see the permissions listed on the left eg

-rw-rw-r--

first character is file type. We see - because its a file. We will see d if its a directory

rw- (user/owner)

r-- (group)

r-- (others, everyone else)

• Owner (rw-): can read and write, but not execute.
• Group (rw-): members of the file’s group can also read and write, but not execute.
• Others (r--): everyone else can only read.

Octal values

• r = 4
• w = 2
• x = 1

• rw- is 4 + 2 = 6
• rw- we know from above is 6 
• r-- is 4

This files permissions are 664, we can set in a few ways:
chmod 664 filename

chmod u=rw,g=rw,o=r filename.

Directories

r = lets you list contents of the directory

w lets you create or delete files inside the directory

x lets you enter the directory with cd or access files within it

Most common octal values

• 644 rw-r--r-- Standard for regular files: owner edits, everyone reads (config files, web content)
• 755 rwxr-xr-x Standard for directories and executable scripts/binaries: owner full control, others can read and run
• 600 rw------- Private files: SSH private keys, credentials, .env files
• 700 rwx------ Private directories (e.g. ~/.ssh) or private scripts
• 664 rw-rw-r-- Shared files where your group collaborates
• 775 rwxrwxr-x Shared directories or scripts for a group
• 770 rwxrwx--- Group-only shared directory: owner and group full access, outsiders locked out entirely
• 640 rw-r----- Files a service’s group needs to read but nobody else should (e.g. some log or config files)
• 400 r-------- Read-only even for the owner; AWS .pem keys often require this

Ones to avoid / watch out for:

Anything ending in 2, 3, 6 or 7 in the last digit means “others” can write. That’s the real thing to watch for, not just 777 specifically. You can find world-writable files with:

777 (rwxrwxrwx) is the classic one to avoid. Anyone on the system can read, modify, replace or execute the file. On a web server it’s a common path to compromise: an attacker who gets any foothold can rewrite your scripts. It’s usually a sign someone hit a permissions error and gave up debugging.

666 (rw-rw-rw-) has the same problem without execute. Anyone can overwrite or empty the file.

Seeing hidden files

ls -a

.hiddenfile

See the permissions on hidden files

ls -la

chmod - change mode

chmod g+w,o-r access.txt

Give group write permissions

Remove read permissions from others (everyone else)

Add and delete users

root user is like the administrator account on windows

its the most powerful account so needs to be managed carefully

It's common to not allow remote logins from the root account

root account has access to everything so accidental deletion of files is a risk

we also don't know who did what if we don't use named account we just know someone logged in as root did some action

sudo lets users run commands as an elevated account

users are given sudo via the sudoers file

this way they can login as named.account but run binary

sudo useradd user9 (adds the users, this will auto create a group of the same name too)

sudo userdel user9 (remove the user)

sudo groupdel user9 (you will need to remove the group created for the user too)

sudo usermod (with different switches changes users settings like home directory, login name and you can lock the account)

sudo chown (change the ownership of file or directory 

sudo users will still be a target for attackers

The "man" or manual command gives detailed information about a command and its switches

man tail 

whatis gives a shorted description 

whatis tail

Find commands with certain works

apropos password

apropos -a change password

More help online:

https://unix.stackexchange.com/

Terms

• Absolute file path: The full file path, which starts from the root
• Argument (Linux): Specific information needed by a command
• Authentication: The process of verifying who someone is
• Authorization: The concept of granting access to specific resources in a system
• Bash: The default shell in most Linux distributions
• Command: An instruction telling the computer to do something
• File path: The location of a file or directory
• Filesystem Hierarchy Standard (FHS): The component of the Linux OS that organizes data
• Filtering: Selecting data that match a certain condition
• nano: A command-line file editor that is available by default in many Linux distributions
• Options: Input that modifies the behavior of a command
• Permissions: The type of access granted for a file or directory
• Principle of least privilege: The concept of granting only the minimal access and authorization required to complete a task or function
• Relative file path: A file path that starts from the user's current directory
• Root directory: The highest-level directory in Linux
• Root user (or superuser): A user with elevated privileges to modify the system
• Standard input: Information received by the OS via the command line
• Standard output: Information returned by the OS through the shell
  

Databases and SQL

Working in cybersecurity we will need to look through lots of data. This data will often be stored in databases so we will use SQL queries to search the data and pull out the information we need.

Example table "employees"

Tables have rows and columns. Columns are the top headings. 

A row is some times called a record too. This is the single line entry 

USERID, DEVICEID, USERNAME, DEPARTMENT, LOCATION

9, xxxxxxx, bob, marketing, NYC

Imagine this table has thousands of entries, many users with different details. We may need to pull out all the users in a certain location. Or find where a user is based off their device ID etc.

Two tables can be connected if they share a common column. For example we might have DEVICE is the employees table and the machine table. These are called keys

Primary key - a column where every row has a unique entry, eg USERID

No duplicates or empty values allowed.

Foreign key - a column in a table that points to a primary key in another table, eg DEVICE ID. Here we can have duplicates or null. For example two users may use the same DEVICEID or a new user may not have a device assigned yet so has NULL. It's allowed because its not the primary key in the current table.

Primary key

• A column (or group of columns) that uniquely identifies each row in a table, e.g. UserID.
• Every value must be unique, so there are no duplicates.
• It can never be empty (NULL).
• A table has only one primary key, though that key can be made of more than one column (a composite key).

Foreign key

• A column that references a primary key (or a UNIQUE column like MAC address) in another table, e.g. DeviceID in the Users table pointing to DeviceID in the Devices table.
• It links the two tables together.
• It can contain duplicates, because many rows can point to the same row in the other table (a one-to-many relationship).
• It can be NULL, meaning “not linked to anything,” unless the designer adds a NOT NULL rule.
• Any value it does hold must exist in the referenced table, so you can’t point to a row that isn’t there (referential integrity).
• A table can have many foreign keys.
• It can reference its own table (self-referencing), e.g. ManagerID pointing to EmployeeID.

The main idea

• The values a foreign key points to are unique in their own table. The foreign key column itself can repeat them or be empty.

SQL - Structured query language

A Query is a request for data

Many databases have adopted this query language for getting data from the database

Often accessed via the CLI (eg mysql or sqlite3) but some have web interfaces where we can run queries.

SQL is more efficient as we can select the relevant tables / columns etc so we are just looking at the relevant data.

Joining tables

Some security-related decisions require information from different tables. SQL allows the analyst to join multiple tables together when returning data. Linux doesn’t have that same functionality; it doesn’t allow data to be connected to other information on your computer. This is more restrictive for an analyst going through security logs.

Sometimes we will be using SQL databases sometimes we will be grep'ing text based logs like csv files etc.

Basic SQL queries 

• select - what to look for
• from - from which table
• lines end with a semi colon;
• * - all

SELECT user_id, device_ic FROM employees;

SELECT * FROM employees;

We can add useful terms to the end of our select statements

LIMIT the output, useful when crafting a query before executing on a large dataset

LIMIT 100

Order by a specific column

SELECT * FROM log_in_attempts ORDER BY login_date, login_time

Filter dates and numbers

• strings - like usernames
• numeric - time and dates

In cybersecurity dates and numbers you may come across in logs.

• the number of login attempts
• the count of a specific type of log entry
• traffic tx
• traffic rx
• login dates
• login times
• dates for patches 
• the duration of a connection

Operators

• = equals
• > greater than
• < less than
• <> not equal to
• >= greater than or equal to
• <= less than or equal to

Lets say we want to see all logins after business hours

SELECT * 

FROM log_in_attempts

WHERE time > '18:00';

Between operator

Search for a range

SELECT * 

FROM machines

WHERE OS_patch_date BETWEEN '2021-03-01' AND '2021-09-01';

Note about single quotations

For dates we use quotation marks but numbers we don't eg:

WHERE userid BETWEEN 8 and 9;

update palo alto firewall via CLI

When updating from the web gui in a rush its a bit painful

• Do dynamic updates check
• Go to Software
• Unclick Base releases
• wait
• Unclick preferred releases 
• wait
• check for updates
• download the version you need
• install

CLI commands

request system software check (optional, lists all updates without filters)

request system software download version 11.2.7-h16  (download the version we need)

request system software install version 11.2.7-h16 (install the version we need)

palo alto common apps

ssl

web-browsing

dns-base (may need to allow your dns server specifically)

ms-onedrive-business

ms-office365-base

ms-update

ms-teams

windows-push-notifications

outlook-web-online

oscp (for cert info lookups)

windows-defender-atp-endpoint

microsoft-intune

google-base

google-update

youtube-base

dtls (voice)

May need to disable these ones for audits/bpa

stun

quic-base

palo alto user issue

User id wants to see domain\user

need to tick box in user mapping to allow username without domain

 palo dns app rules

add dns-base / dnscrypt etc

debugging dap / hostscan on FTD

Notes:

DAP policy is applied to all anyconnect profiles so your DAP rules must cover all. You can't apply it to just one profile

You need to update to latest CSC but also match the posture package and the SSO (secure external browser package) to the same version.

If CSC is on 5.1.17, then the other two need to be on 5.1.17. You may only need the SSO package if their MFA is redirecting to a webapge.

Secure client section in endpoint criteria can be used to select platform to know if its on widnows or mobile

I hit an issue. The fix was to match the hostscan module to the same version as the secure client.

If you are having issues upgrade to latest/recommended release.

Keep in mind when DAP is switched on its global for all anyconnect profiles so you need to make sure you have DAP rules setup to cover everything.

Posture is only checked once on connection its not a constant thing (like CSA, which is still only checking/enforcing every 5-15 minutes)

If you are still having issues:

• Start a putty session with logging enabled
• sh run all dynamic-access-policy-record
• debug dap trace 255
• debug dap errors
• apply the DAP in FMC and push policy
• sh run all dynamic-access-policy-record
• show tech
• send the output to cisco tac

FMC interface details

 - Go to **System (gear) > Health > Monitor**

- Select the **FTD device**

- Open the **Interfaces** dashboard/widget(s)

- Change the **time range** (top-right time selector) to **Last 12 Hours**, **Last 24 Hours**, or **Custom**

- Select the Interface you are interested in (default is avg of all interfaces)

mib / oids for cisco secure firewall

 Recommended official sources to download/browse MIBs:

- Secure Firewall SNMP MIB Reference Guide (HTML):  

  https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/mib/cisco-secure-firewall-mib-reference-guide.html

- Secure Firewall SNMP MIB Reference Guide (PDF):  

  https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/mib/cisco-secure-firewall-mib-reference-guide.pdf

- Cisco SNMP Object Navigator (look up OIDs/MIB names):  

  https://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseOID.do?local=en

- Cisco public MIB repository:  

  https://github.com/cisco/cisco-mibs

- SNMP configuration guidance for Firepower/FTD (also includes common OID references):  

  https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/213971-configure-snmp-on-firepower-ngfw-applian.html

Cisco Secure Access notes

Intro to Cisco Secure Access (CSA)

At a high level cisco secure access (which we can call CSA from here) works like this:

• Users > CSA > Resources
• The idea is to secure access from anywhere to anywhere
• CSA can connect and protect users while in the office, at home or on the move.
• Likewise CSA can provide access to resources on your private sites, on the internet and in public or private cloud hosting.
• CSA has two main modules SIA and SPA
• SIA is Secure internet access ( replacement for umbrella )
• SPA is Secure Private access ( replacement for AnyConnect VPN)

Ways to connect to CSA

• Remote managed > ZTNA  > CSA
• Remote managed > VPNaaS > CSA
• Remote unmanaged > Clientless ZTNA > CSA
• Branch > IPsec tunnel > CSA
• IOT devices > IPsec tunnel > CSA
• We can also integrate SD-WAN connections into CSA (more on that later)

What we can do inside CSA

• Groups
• firewall rules (one location for all policies)
• web gateway
• DLP
• CASB (cloud security broker)
• Device posture
• ZTNA
• Monitor and troubleshoot with AI insights (thousand eyes)

Outbound from CSA

• Connections to Internet and SaaS sites
• Backhaul to private apps hosted in your public or private cloud
• IPsec tunnels to other datacentre/pop/branch

PoP stands for point of presence. Often users will connect to the closest one for lowest latency. For example, a CSA connection can enter the POP in Dublin and exit the POP in France to reach a resource located in France.

What problem is cisco secure access trying to solve ?

• Orgs with remote users and 3rd party contractors who need access but also need it to be secure 
• Orgs with users who are mobile (in office / at home / on the road)
• Orgs with hybrid setups (on prem / public cloud / private cloud / SaaS)
• Consolidate all the access policies in one place
• Keep a zero trust mindset

Secure Private Access (SPA)

• ZTNA (Zero Trust Network Access) — least-privilege, identity and posture-based access to specific private apps, rather than broad network access
• VPN-as-a-Service (VPNaaS) — cloud-delivered VPN for use cases where full-tunnel or legacy app access is still needed
• Device posture assessment
• MFA step-up authentication
• Clientless access for unmanaged devices
• Can access via VPN (ipsec), ZTNA client (CSC ZTA module), ZTNA clientless (3rd parties) 

Secure Internet Access (SIA)

• Everything in umbrella today is n SIA
• VPN full tunnel
• Internet security module
• Branch DIA
• DNS-layer security (inheriting Umbrella's DNS capabilities)
• Secure Web Gateway (SWG) — web proxy and filtering
• Cloud Access Security Broker (CASB) — visibility and control over SaaS apps
• Cloud-Delivered Firewall (FWaaS)
• Data Loss Prevention (DLP)
• Intrusion Prevention System (IPS)
• AI usage visibility and controls

We can have SPA and SIA working together

Insights and monitoring

Admins can monitor endpoint performance with the help of cisco thousand eyes

You need an account and agent deployed (part of the cisco secure client)

Global scale architecture 

User > CSA POP > CSA routing > CSA POP > Resource

Unified cloud architecture 

• Control everything in one cloud dashboard
• Traffic acquisition 
• Collect and augment with extra data (posture etc) 
• Classify traffic (public / private)
• Rules (FWaaS / SWG / CASB / Decryption / IPS / DLP)
• Send via backhaul or internet 

Open APIs

• As well as the cloud dashboard
• Multiple Restful API
• Automate tasks
• Deployment
• Admin
• Policies
• Reports

Talos threat intelligence 

Visibility across the entire threat landscape fusing experts data and gen AI

Talos detect threats and block them for all customers

User connectivity

• VPNaaS
• ZTNA module
• Web roaming module (80/443 only)
• Clientless ZTNA

VPN (DTLS/IPsec) > ZTNA (Wireguard/gRPC) > ZTA (MASQUE/QUIC)

TLS - TCP security

DTLS - UDP (some speed improvement)

QUIC is UDP based (fastest), a way to speed up TLS connections

MASQUE - Multiplex Application Substrate over QUIC encryption / a streaming protocol. This is an application proxy that runs on top of QUIC. It can have multiple streams active in one MASQ session.

Client connectivity 

Secure client 

VPN > ASA> IPsec / Internet 

ZTNA client > ZTNA proxy > IPsec / Resource connector 

Sec/Roaming module  > DNS/SWG > Internet 

 

Clientless > Rev Proxy > IPsec / Resource connector 

Branch > IPSec > IPsec / Internet 

Cisco Secure Client

You will need to deploy the CSC client with the ZTNA module

Duo desktop will also be deployed if you use posture

Other modules

• Secure endpoint (formerly AMP)
• Roaming module (Umbrella but this will be replaced)
• Thousand Eyes (no UI)
• Cloud management module (no UI)
• DART

Secure Private Access (client based ZTNA)

ZTNA supports apps via IPsec backhaul

FTD > HA VTI tunnels > CSA

We create two tunnels to CSA for redundancy 

We configure BGP between the two so they can exchange routes

Secure Private Access (clientless)

Only works with web apps

Secure Private Access (VPN)

Connect to secure access cloud

Secure Internet Accesss via VPNaaS

Connect to CSA then on to internet sites / SaaS

Modular policy with magnetic UI

Define apps / resources

define private / public rules

Live demo

https://www.cisco.com/c/en/us/products/security/secure-access/live-demo.html

Cisco have a live demo which you can try it out

First step will be to setup a tunnel group (VPN)

Setup on your peer on the HQ or branch

Connector groups are for the resource connectors

We can add one to AWS Azure and VMware

We can add SAML/SSO for our user ID

Private resources 

We can had a file server here

You can make firewall rules under secure

Zero trust 

• Micro segmentation 
• Network isolation
• Native OS support
• TPM to protect certs and key

Principals 

• Never trust
• Always verify
• Enforce least privilege 

Success factors

• Allow the user to work securely with minimal disruption
• Adjust policy to risk
• Consistency across environments because of shared policy

AI assistant

Helps you create rules but leaves them disabled, a human must enable the rule.

Planning for a CSA project delivery

• Well defined scope and timelines
• Access to sites / network devices etc
• Clear roles and responsibilities
• Single customer point of contact / PM
• Customer involvment and comms
• Clearly defined and agreed use cases
• Pilot and customer validation
• Knowledge transfer
• High level docs
• SOW - statement of work
• BOM - Bill of materials
• Checklist

Secure Access licensing 

Essentials 

• Secure internet access (SIA)
• Secure Private Access (SPA)
• SWG
• ZTNA
• L3/4 firewall
• CASB
• RBI (for risk traffic or high level phishing targets)

Advantage

• Everything in essentials 
• Layer 7 firewall
• IPS
• DLP
• RBI

Licensing subscriptions

based on per user 

1 year

3 year

5 year 

Non standard terms on per contract basis 

Cisco user protection suite

Incorporates related technologies all into one solution

• Posture and authentication management 
• Endpoint security 
• Email security 
• Experience insights
• Remote browser isolation
• Security Service Edge 

Client based ZTNA

• Authentication and posture per session 
• QUIC tunnel (MASQUE proxy)
• Carry private traffic all ports and protocols
• SAML authentication and auto re-new

Where ZTNA fits in the stack

• Application
• Socket intercept/filter happens her (Zero trust access module)
• Packet intercept/filter
• routing table
• packet intercept/filter
• virtual interface
• physical interface 

IP packet vs socket streaming 

VPN and legacy ZTNA packet approach

• CGNAT (carrier grade nat was a large IP block carved out for ISP's to use. These 4 million IP's were taken out of the public IPv4 space. This way it wouldn't overlap with 10.0.0.0/8 in use on the private space.
• CGNAT is obfuscation not security
• Firewalls and NAT's
• Attackers can piggyback on UDP flows to continue them in IP packet systems

Streaming approach (modern ZTNA uses socket streams)

• Socket streaming allows any protocol to be tracked by socket call and terminated at the instance the socket is closed
• Socket streaming eliminates timers and is deterministic
• Flows can't be continued or hijacked

Streaming approach intercepts the traffic before it becomes a packet. The traffic only needs to pass through the OS kernel once. 

App > Socket intercept > MASQ ZTNA > Kernel > Packets on the wire

ZTNA module

A module part of CSC (cisco secure client) previously AnyConnect client 

Enrolment

Users just need to press the "Enroll" button once on the ZTNA module in CSC

CSA issues an authentication cert for the client

Cert is saved in the TPM

This cert is automatically renewed

Client connections are now streamed

Stream1: data + posture

Stream2: data + posture

Stream3: data + posture

By default everything is dropped (ZTNA). We need to allow traffic in the rules.

Posture levels vary

VPNaaS

• OS
• Antimalware
• Firewall
• Disk encryption
• Cert check
• Browser check
• File check
• Registry check (windows only)
• Process check

Client based

• OS
• Antimalware
• Firewall
• Disk encryption
• System password

ZTA Browsers

• OS
• Browser check

We can set a re-auth timer if needed 

Enrolment more details:

• On the surface for the user they press an enrol button
• On the backend a lot is going on

What is a TPM chip

Trusted Platform Module is a dedicated security chip built into a computer's motherboard that provides hardware-based security functions:

• Stores cryptographic keys — It securely holds encryption keys, passwords, and certificates in hardware, separate from the main CPU and RAM, making them much harder to steal.
• Verifies system integrity — At boot time, it checks that the firmware and OS haven't been tampered with (this is part of "Secure Boot").
• Enables full-disk encryption — Windows BitLocker, for example, uses the TPM to store the encryption key for your drive, so the drive can't be unlocked on a different machine.
• Supports authentication — Used for multi-factor authentication, smart card functions, and secure login.

What is DPOP

DPoP (Demonstrating Proof of Possession) is a security mechanism defined in RFC 9449 that proves a client cryptographically possesses the private key associated with a token or credential — without ever exposing that key.

The Core Problem DPoP Solves

In traditional OAuth/token flows, a bearer token can be stolen and reused by anyone. DPoP binds a token to a specific key pair, so even if the token is intercepted, it's useless without the corresponding private key (which is stored in the TPM chip on the clients machine).

How DPOP works

• Device enrolment is initiated
• Key pair is generated. Private key locked in TPM and never leaves the chip. Public key extracted.
• CSR created with public key, signed by private key (to prover ownership)
• CSR is sent to CSA. The CSR contains the public key and signature
• The signature proves we have the private key but we never send the private key. It never leaves the TPM chip.
• CSA takes the CSR and issues a signed cert (bound to the public key)
• When accessing CSA, a DPOP proof (JWT) is created
• Signed by: the TPM held private key 
• Contains: HTTP method, URL, timestamp, nonce
• Proves the caller holds the private key right now

How DPOP and ZTNE enrolment works on the backend

• ZTA starts the DPOP process. Generates the public/private keys and the CSR
• Private key is stored in the TPM and is never transmitted
• CSR / Public key sent to CSA for enrolment
• user > enroll.ztna.sse.com > enrolment broker
• enrolment broker asks for email
• user > me@address.com > enrolment broker
• enrolment broker sends SSO redirect
• user > SAML flow > Auth (customer IDP / Duo / AD/entra etc)
• Device is registered
• ZTA cert issued
• From here the cert can be used for all connections and MITM attacks are not possible
• The cert automatically updates every 2 weeks

OS native ZTA for apple and android devices

Just like having the ZTNA module on the devices

Enroll the device

Login via SSO

Clientless zero trust access

Essentially this will be web browsers for 3rd parties

Allows access to web apps only

Can use IPsec tunnels or resource connectors

For unmanaged BYOD devices 

For 3rd parties 

Limited posture detection

It makes a reverse proxy

VPN as a service (VPNaaS)

Auth and posture at connect time

DTLS tunnel

Carry internet and private traffic (all ports and protocols)

SAML 2.0 auth

ISE integration

CSA Supports SAML and RADIUS auth methods. SAML is new but RADIUS is widely used including in ISE

• client > auth request > VPNaaS > ISE
• Client redirected to ISE
• SSL connection to port 8443, user download network setup assistant
• Network setup assistant discovers ISE, CSC agent download/install
• CSC ISE posture discovers ISE
• SSL exchange on port 8443 > compliance check
• Connection is protected by portal cert
• CoA (change of auth) request, CoA ack
• In VPN use case CoA packet contains the attributes which compliant profile has

ISE SGT support

SGT is a security group tag

CSA can carry SGT's through its networks tunnels

Some sample SGT's

SGT 10 is marketing

SGT 20 IOT

SGT 30 BYOD

SGT 40 Workstations

• This allows for SGT policy across the HQ LAN network and cloud
• maintain micro segmentation
• Identify devices and traffic based on context from ISE
• Apply policies to SGT based identity 

Radius setup example

Connect > End user connectivity 

VPN profile

The system pool is for CSA to talk to radius/ISE

Add VPN IP pool

endpoint pool 172.16.0.24

mgmt pool 172.17.0.0/21

dns servers: internal DNS

Radius groups not added yet

You can add your radius server group

Tick AAA options

Assign the radius servers (ISE1 and ISE2)

You can have different server for each region or one radius group for all.

Network tunnels

CSA <> your site

hub1  < > VTI1 > Your FW

hub2  < > VTI2 > Your FW

Makes ECMP group, routes are advertised with BGP

IPsec routing

Static or dynamic routing 

Use static for small network or your devices doesn't support BGP

In most other cases you will want to use BGP

Branch connections

Allow branch connections to let them reach private resources

S2S tunnels  from HQ FW 

Catalyst SD-WAN 

Why enable NAT 

• NAT allows devices to use a single public IP to connect to the internet CSA
• NAT can be used to hide the real LAN IP of users connecting to CSA.
• This can also help if the same networks are used in two of your locations eg 192.168.1.0 used in two places.

Branch/DC to VPNaaS User

Internal network (pri/sec tunnels) > ECMP > Cloud headend > CSA > tunnel establish > VPN pool IP

Catalyst SD-WAN

VPN1 > SD-WAN > VPN tunnels > CSA

VPNID based policy 

DIA

Direct Internet Access

Going straight out the local branch internet connection

Resource connectors

CSA > Connector group > AWS/Azure/VMware

2x Connectors in HA is recommended

RC gateway

RC agent

RC group

ZTA > QUIC > ZTA proxy > CSA > Resource gateway > Resource connector > App

Resource connectors can help with overlapping IP's too

RC connectors use TCP 443 and UDP 443

RC status

• Connected - data tunnel is up
• Disconnected - data tunnel is down
• Disabled - admin disabled the connector
• Updating - software update in progress
• Expired - Cert has expired
• Ready to use - newly provisional and reach able
• Deleted - deleted by admin
• Revoked - revoked by admin
• Setup failed - Tunnel failed to come up

There are several FQDN's you need to whitelist: 

TCP 80/443

UDP 443

Gateway: Cisco IP space

Controllers:

Us.controller.acgw.sse.cisco.com

Eu.controller.acgw.sse.cisco.com

Ap.controller.acgw.sse.cisco.com

Will resolve to AWS Static IPs

Repo:

Us.repro.acgw.sse.cisco.com

Eu.repo.acgw.sse.cisco.com 

Ap.repo.acgw.sse.cisco.com 

ACME: Prod.acme.sse.cisco.com    

API Gateway: Api.sse.cisco.com   

PKI: Ssepki.cryptosvcs.cisco.com

Resource connector redundancy

Scaling calculator built in.

2 agents per connector group

All agents have same connectivity 

Multi region

CSA > RC gateway region 1 > Agent 1 + agent 2 > private resource 

CSA > RC gateway region 2 > Agent 1 + agent 2 > private resource

They can deployed quickly in common virtualisation platforms.

Setting up a connector

Connect > network connection > resource connector groups

Name it 

Select region

Select your connector type for example AWS

Download the image for AWS

View purchase options subscribe to this software

Launch via EC2

Give the EC2 instance a name

Create a new key pair (for connecting to CSA)
Allow public IP to be auto assigned 

Conform connection

Copy provision key from CSA to AWS

KEY=xxxxxxx

It should show as connected after a few minutes

Define a private resource

Select out RC connector we just created

Secure Internet Access

Internet app/ SaaS apps

+

Private apps

=

Security Service Edge (SSE), secure access from anywhere to anywhere

Features of  cisco's SSE

• ZTNA
• SWG
• DNS security 
• FWaaS
• CASB
• RBI
• DLP
• VPNaaS

Policy enforcement

If you have all modules enabled the traffic will be processed in this order

• DNS polices
• Firewall (IPS/IDS)
• SWG (Web/Casb) 80/443 traffic
• DLP

Access rules

In CSA there are two main kinds of rules

• Private access rules (for accessing your own resources)
• Internet access rules (for access internet and cloud resources)

Anatomy of a rules

• Name (description of the rule)
• Type (Internet, private)
• Action (allow, block, warn(lets user go ahead), isolate (RBI))
• Identities (Users, groups, computers, networks, tunnels etc)
• Protection profiles (see below)

Protection profiles

• Web profile (AAA, decryption, threat protection, file and security controls)
• Tennant Control Profile (m365, G-suite, slack, drobox)
• IPS profile (Signatures lists, defaults, actions)
• Endpoint posture (VPN, ZTNA, browser based)

DNS security

• Block malware / phishing / CnC callback URLs
• Only proxy risky domains to improve performance
• Stop threats at the DNS lookup stage, before a connection is made
• Doesn't work for IP based threats

When traffic is proxied it gets further inspection

3 ways to configure DNS security in CSA (you probably need all)

• Point DNS at CSA and register public IP (all DNS requests from this public IP are protected
• Roaming security, use the module in the CSC client , 
• Virtual appliance forwarder - log DNS requests from internal IP's for more identity

CDFW flow

Network > IPsec tunnel > CSA > CDFW > SWG (80/443) > Internet/SaaS

IPS tuning

Start in detection mode

Review results, create exceptions for known good traffic

Enable protection mode, this will start blocking now

SWG and CASB

Secure web gateway full web proxy 

SWG allows filtering of all web traffic and detailed information

Enabling SSL decryption allows advanced features

Decryption strategies

Most traffic is encrypted today so decryption is essential

Decryption is resource intensive 

Traffic > IPS > SWG >

Advanced features 

• Decryption 
• SAML
• Content controls
• Tennant controls
• Granular app controls 
• File type controls
• File scanning 
• Data loss prevention 
• Remote browser Isolation

 

Advanced application controls

For example we can visit Facebook but we can't download/upload files

Revered Egress IP

SaaS apps require allow list (public IP) 

We can have a static IP in CSA so our internet traffic comes from the same IP

This public IP can be allow listed by your SaaS app vendors

Cloud Access Security Broker (CASB)

• Control SaaS app usage 
• Alert on risky apps 
• Secure outbound web traffic with inline and OOB (out of band) DLP
• detect and remove malware from cloud storage apps
• This will become more important as more SaaS / cloud applications are used

CASB Inline proxy

High impact deployment

agent or traffic redirection

No API to app

limited retro 

real time enforcement inline

CASB Out of band/API

Low impact deployment 

agentless, no user experience impact

relies on api of cloud apps

retrospective (we can look back in time)

near real time enforcement 

universal coverage 

sanctioned app coverage 

App discovery and controls

• Detects cloud apps in use
• Organised by category and risk level
• You can see number of users inbound/outbound traffic
• You can block high risk categories 

Application risk override

Modify an apps risk score

Community risk score is the median of all other CSA customers to give you an idea of an app

Tenant controls 

Only allow access to the corporate m365. Don't let users into their own personal tenants. This is to help with data exfiltration.

Remote browser isolation 

Web browser > SWG > File inspection > Isolated browser (AWS) >  Risky Website

The site never loads on the users device

Only works with web apps

DLP can be run on an isolated session too

Multi-faced threat intel

• DNS
• IP
• BGP
• SSL
• WHOIS
• HASH
• WEB
• ETC

CSA uses all the data it gathers from across the world to categorise and find malware domains and IP's.

Secure malware analytics

Sandbox inspection is done on high risk files

libmagic makes sure a .pdf is actually a .pdf file

DLP data loss prevention

You can block certain data leaving your network

For example credit card numbers can be blocked

Real time DLR

SWG

scans web traffic in line 

SaasS API DLR

Cloud API's for data at rest without SWG proxy

scans out of band web traffic

On management interface for both

DLP categories 

DLP has categories which can be selected.

Can monitor chatgpt the outbound traffic can be blocked

Can also block inbound generation like source code.

Digital experience monitoring (DEM) / Experience Insights 

Today we have users spread across multiple locations

The users are moving between home / office / hotels etc

DEM helps track down issues

• availability 
• performance 
• quality 

Types of questions we can get the answer to in one place with CSA

Is it home network / WIFI

Is it the endpoint ? Is the laptop managed or BYOD

Is the issue office LAN / WIFI

ISP problem ?

Security rule blocking and where DNS / firewall / endpoint ?

Client / server application problem ?

VPN gateway issue ?

Record metrics on how connections are working. Then use that data to help the customer TS issues and solve problems

CSA Experience Insights 

Give visibility into 3rd party parts of the network like home WIFI / ISP BGP / Cloud services

Uses thousand eyes

part of base package

• Local device 
• Collaboration applications (webex / teams)
• Internet and network path (map out network path, latency, jitter, loss etc)
• SaaS performance 

Integration with thousand eyes

Thousand eyes endpoint (embedded endpoint agent EPA) is included in the CSC

Need to create a token and exchange 

Global visibility within the CSA dashboard

Use cases

Remote worker - CSA, we can see the WIFI signal strength is bad

ISP  - We can trace the network path, we can see the local WIFI is the problem as other end is reporting fine

Application - For example we can connection is all good, 4 apps working fine, 1 app is an issue this points to an issue on that SaaS app

CSA - We can look inside CSA as well. Is CSA slow or is it blocking ? We can look at endpoint posture. Check the posture status as this may be stopping the user from getting access 

Proactive monitoring endpoint 

Thousand eyes agent can run synthetic tests 

They can be scheduled 1 / 5 / 15 minutes 

We should be able to see when connections become unhealthy

Device > GW > Internet > Application 

Experience scanner for end users

User can see their own score

For example it might report and issue with the local internet connection

They can reboot their WIFI themselves

If they see the issue is with a SaaS app then they know its out of their hands

AI / experience insights

Cisco AI will bubble up high level alerts to the CSA admin

AI can investigate and generate suggestions

It can pick up the SaaS applications with the worst performance

RA VPN to VPNaaS migration path

• Get the current state of existing RA VPAN so we can design CSA
• Solution requirements and design
• Implementation and testing
• Migration plan and execution 
• Knowledge transfer 

RA VPN to VPNaaS 

Moving your VPN to the cloud

Old RA VPN headend was on firewall or multiple firewalls

CSA VPN headend is one point in the cloud and get your access to everywhere

• Configuration porting > Intent mapping > Data plan transition
• Source assessment > Intent analysis > Move to secure access
• Often migrations are done like for like but a migration to CSA can bring in new features easily

Migration phases

• Scope
• Provision
• Stage 
• Go live 

Milestones

• Configuration porting ( migrating the config )
• Intent mapping ( review of rules)
• Data plan transition ( moving live traffic from old RA VPN to CSA )

Let's take an example

• The customer currently has a legacy RA VPN.
• They have local VPN users
• They don't use any MFA on this
• They don't have any posture checks
• Once connected VPN users have access to the full network

You can see migrating like for like in this case would not be good and would not increase security.

In CSA

We can enable identity source from entra / AD to get user identity

We can enable MFA with Duo

We can enable posture checks

We can enable ZTNA so users only get access to what they need

Migration path

Traditional VPN > VPNaaS > Unified ZTNA

Umbrella to CSA

Why upgrade from umbrella to CSA

Safer - Zero trust access, ID intel, adaptive access, always monitoring and blocking

Better - 4x faster SIA, frictionless access to all Apps, monitor and maintain DEM/experience insights 

Taking umbrella to the next level

• ZTNA
• AI for security 
• Easier connectivity 

Umbrella upgrade path

Umbrella DNS > SIG > Secure Access

DNS - DNS only (still very good security)

SIG - SWG and advanced features, for outbound user internet traffic only

CSA - connecting all resources via the cloud and providing all the security of above in one dashboard with one policy set. Connect from anywhere to anywhere securely.