WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.790 align:middle line:90%
I bet some things are pretty
frustrating for network

3
00:02.790 --> 00:03.300 align:middle line:84%
devices.

4
00:03.300 --> 00:05.240 align:middle line:90%
Consider the
FirePOWER appliance.

5
00:05.240 --> 00:07.340 align:middle line:90%
If we have traffic
that's going through,

6
00:07.340 --> 00:10.320 align:middle line:90%
and we have a policy that says
look at the application layer

7
00:10.320 --> 00:13.860 align:middle line:90%
information and permit this or
deny that based on the layer 7

8
00:13.860 --> 00:17.160 align:middle line:90%
information-- well, if
that data is encrypted,

9
00:17.160 --> 00:21.090 align:middle line:90%
where they're using SSL or TLS
for encrypted sessions between

10
00:21.090 --> 00:22.410 align:middle line:84%
clients and servers--

11
00:22.410 --> 00:24.990 align:middle line:90%
because it's encrypted, that's
really tough for the FirePOWER

12
00:24.990 --> 00:26.490 align:middle line:84%
appliance to do its job.

13
00:26.490 --> 00:31.530 align:middle line:90%
So a solution to that is
to do SSL/TLS decryption
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:26.490 --> 00:31.530 align:middle line:90%
So a solution to that is
to do SSL/TLS decryption

14
00:31.530 --> 00:33.450 align:middle line:90%
and how the FirePOWER
appliance act

15
00:33.450 --> 00:36.810 align:middle line:90%
as a sort of man in the middle
so that, for a few moments,

16
00:36.810 --> 00:40.290 align:middle line:90%
it has the naked data, so it
can do its proper inspections,

17
00:40.290 --> 00:42.990 align:middle line:90%
analysis, and traffic
control based on what's

18
00:42.990 --> 00:43.930 align:middle line:84%
really going on.

19
00:43.930 --> 00:45.870 align:middle line:90%
In this Nugget, I'd
like to talk with you

20
00:45.870 --> 00:48.802 align:middle line:90%
about the concept
of SSL decryption,

21
00:48.802 --> 00:50.510 align:middle line:90%
where we would go to
create the policies,

22
00:50.510 --> 00:52.560 align:middle line:90%
and how to include
those policies as part

23
00:52.560 --> 00:55.720 align:middle line:90%
of our overarching
access control policy.

24
00:55.720 --> 00:58.590 align:middle line:90%
So let's use this topology,
and let's use Bob once again.

25
00:58.590 --> 01:01.650 align:middle line:90%
And let's put Bob
here at computer 1.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.590 --> 01:01.650 align:middle line:90%
And let's put Bob
here at computer 1.

26
01:01.650 --> 01:04.019 align:middle line:90%
Now, Bob, if he wants
to go out to a website--

27
01:04.019 --> 01:07.380 align:middle line:90%
let's imagine he wants to
go to a gaming website,

28
01:07.380 --> 01:10.410 align:middle line:90%
and we have a policy on the
FirePOWER appliance that says,

29
01:10.410 --> 01:14.812 align:middle line:90%
hey, any websites in the gaming
category are not allowed.

30
01:14.812 --> 01:15.645 align:middle line:84%
So Bob's frustrated.

31
01:15.645 --> 01:16.620 align:middle line:84%
And what does Bob do?

32
01:16.620 --> 01:18.510 align:middle line:90%
Bob does a Google
search and says, wow,

33
01:18.510 --> 01:19.800 align:middle line:84%
I can set up a tunnel?

34
01:19.800 --> 01:22.500 align:middle line:90%
So Bob sets up a
tunnel, and he goes out

35
01:22.500 --> 01:24.510 align:middle line:84%
to a website via tunnel.

36
01:24.510 --> 01:25.950 align:middle line:90%
And then from that
tunneled site,

37
01:25.950 --> 01:28.380 align:middle line:90%
he then goes out to
his gaming website,

38
01:28.380 --> 01:31.890 align:middle line:90%
and the reply traffic
goes back this direction
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.380 --> 01:31.890 align:middle line:90%
and the reply traffic
goes back this direction

39
01:31.890 --> 01:33.180 align:middle line:84%
and this direction.

40
01:33.180 --> 01:35.070 align:middle line:90%
And the FirePOWER
appliance is none the wiser

41
01:35.070 --> 01:37.750 align:middle line:90%
because, while the traffic
was in that tunnel,

42
01:37.750 --> 01:38.700 align:middle line:84%
it was encrypted.

43
01:38.700 --> 01:42.750 align:middle line:90%
And if we're using SSL or TLS,
the FirePOWER appliance cannot

44
01:42.750 --> 01:46.080 align:middle line:90%
see the application layer data
to see where that traffic was

45
01:46.080 --> 01:46.910 align:middle line:84%
really going to.

46
01:46.910 --> 01:49.860 align:middle line:90%
Now, what the firewall
could do is also

47
01:49.860 --> 01:52.960 align:middle line:90%
have a policy saying, hey,
no tunneling sites allowed.

48
01:52.960 --> 01:55.350 align:middle line:90%
So the initial connection
possibly could be stopped.

49
01:55.350 --> 01:57.517 align:middle line:90%
However, that's just the
beginning of our challenges

50
01:57.517 --> 01:59.700 align:middle line:90%
because, even without
Bob being malicious,

51
01:59.700 --> 02:01.920 align:middle line:90%
there's lots and
lots of traffic that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:59.700 --> 02:01.920 align:middle line:90%
there's lots and
lots of traffic that

52
02:01.920 --> 02:04.890 align:middle line:90%
is being sent using SSL,
Secure Sockets Layer,

53
02:04.890 --> 02:08.180 align:middle line:90%
or the new and improved flavor
of security for HTTPS sessions.

54
02:08.180 --> 02:12.240 align:middle line:90%
That's TLS, Transport Layer
Security, using HTTPS.

55
02:12.240 --> 02:16.980 align:middle line:90%
So even if Bob is doing innocent
things and going using HTTPS,

56
02:16.980 --> 02:19.650 align:middle line:90%
if the traffic is
encrypted, the firewall

57
02:19.650 --> 02:22.230 align:middle line:90%
is going to have a hard time
looking at layer 7 application

58
02:22.230 --> 02:24.450 align:middle line:90%
information because
it's encrypted.

59
02:24.450 --> 02:29.010 align:middle line:90%
So to solve that, what we can
do is we can have the firewall

60
02:29.010 --> 02:32.190 align:middle line:90%
play the role of a
man-in-the-middle attack.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:29.010 --> 02:32.190 align:middle line:90%
play the role of a
man-in-the-middle attack.

61
02:32.190 --> 02:33.930 align:middle line:90%
And it would go
something like this.

62
02:33.930 --> 02:37.590 align:middle line:90%
Bob makes his request
going out to the internet,

63
02:37.590 --> 02:39.820 align:middle line:90%
and it's going to
be an HTTPS session.

64
02:39.820 --> 02:41.920 align:middle line:90%
And the FirePOWER
appliance intercepts that

65
02:41.920 --> 02:44.670 align:middle line:90%
and has this whole little
conversation between Bob

66
02:44.670 --> 02:46.920 align:middle line:90%
and the FirePOWER
appliance while,

67
02:46.920 --> 02:49.733 align:middle line:90%
virtually simultaneously,
the FirePOWER appliance

68
02:49.733 --> 02:51.150 align:middle line:90%
is actually going
out and building

69
02:51.150 --> 02:54.240 align:middle line:90%
a session out to the server
that Bob was trying to get to.

70
02:54.240 --> 02:56.210 align:middle line:90%
And the session is
actually being built here.

71
02:56.210 --> 02:57.210 align:middle line:84%
So we have two sessions.

72
02:57.210 --> 02:59.880 align:middle line:90%
We have session 1 between
Bob and the appliance

73
02:59.880 --> 03:02.400 align:middle line:90%
and another one between the
appliance and the actual server
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:59.880 --> 03:02.400 align:middle line:90%
and another one between the
appliance and the actual server

74
03:02.400 --> 03:03.900 align:middle line:84%
that Bob was trying to go to.

75
03:03.900 --> 03:06.550 align:middle line:90%
So it's encrypted on this
journey and this journey.

76
03:06.550 --> 03:08.700 align:middle line:90%
But here, for a moment,
it's not encrypted.

77
03:08.700 --> 03:10.560 align:middle line:90%
And that's when the
FirePOWER appliance can

78
03:10.560 --> 03:13.680 align:middle line:90%
look at the application layer
information and say, oh, yeah,

79
03:13.680 --> 03:15.160 align:middle line:84%
gee, he's trying to use Gmail.

80
03:15.160 --> 03:15.660 align:middle line:84%
Great.

81
03:15.660 --> 03:16.230 align:middle line:84%
No problem.

82
03:16.230 --> 03:17.407 align:middle line:84%
I'm going to let that.

83
03:17.407 --> 03:18.990 align:middle line:90%
Oh, he's trying to
use a file transfer

84
03:18.990 --> 03:21.570 align:middle line:90%
app or peer-to-peer
software or something else.

85
03:21.570 --> 03:24.250 align:middle line:90%
I'm going to deny
that based on policy.

86
03:24.250 --> 03:26.885 align:middle line:90%
And when we do it in this
fashion, where Bob is going out

87
03:26.885 --> 03:28.260 align:middle line:90%
to the internet,
what we're doing

88
03:28.260 --> 03:31.860 align:middle line:90%
is the actual
firewall is resigning.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:28.260 --> 03:31.860 align:middle line:90%
is the actual
firewall is resigning.

89
03:31.860 --> 03:34.860 align:middle line:90%
Not resigning, but re-signing,
where internal users are

90
03:34.860 --> 03:36.510 align:middle line:84%
going to external resources.

91
03:36.510 --> 03:38.760 align:middle line:90%
And if we have users on the
internet-- let's go ahead

92
03:38.760 --> 03:40.182 align:middle line:84%
and put Lois out here.

93
03:40.182 --> 03:41.640 align:middle line:90%
So Lois is on the
internet, and she

94
03:41.640 --> 03:43.680 align:middle line:90%
wants to go to server
B right here, one

95
03:43.680 --> 03:45.420 align:middle line:84%
of our public-facing servers.

96
03:45.420 --> 03:48.540 align:middle line:90%
As her traffic comes in,
we could also play that man

97
03:48.540 --> 03:50.400 align:middle line:84%
in the middle at the firewall.

98
03:50.400 --> 03:52.885 align:middle line:90%
I guess I should draw this
arrow down here at the firewall.

99
03:52.885 --> 03:54.760 align:middle line:90%
And when Lois is going
to one of our servers,

100
03:54.760 --> 03:56.350 align:middle line:84%
we have these private keys.

101
03:56.350 --> 03:59.070 align:middle line:90%
And so the inbound traffic
to internal servers

102
03:59.070 --> 04:04.030 align:middle line:90%
from external users
is using a known key.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:59.070 --> 04:04.030 align:middle line:90%
from external users
is using a known key.

103
04:04.030 --> 04:06.550 align:middle line:90%
But whether we're resigning
as traffic goes out,

104
04:06.550 --> 04:08.350 align:middle line:90%
or we're using a
known key that's

105
04:08.350 --> 04:10.450 align:middle line:90%
on the server for
the inbound traffic,

106
04:10.450 --> 04:12.820 align:middle line:90%
the idea is that we want
the firewall to have

107
04:12.820 --> 04:16.730 align:middle line:90%
a few moments of time to be able
to analyze that naked traffic,

108
04:16.730 --> 04:19.029 align:middle line:90%
so it can implement the
inspections and traffic

109
04:19.029 --> 04:21.693 align:middle line:90%
control that we want to
have happen in our network.

110
04:21.693 --> 04:23.110 align:middle line:90%
Now, there are a
couple of times--

111
04:23.110 --> 04:26.620 align:middle line:90%
actually, several
times-- when we do not

112
04:26.620 --> 04:29.380 align:middle line:90%
want to do any
kind of SSL or TLS

113
04:29.380 --> 04:33.010 align:middle line:90%
decryption-- for
example, financial.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:29.380 --> 04:33.010 align:middle line:90%
decryption-- for
example, financial.

114
04:33.010 --> 04:36.640 align:middle line:90%
If Bob is going out to
a financial website,

115
04:36.640 --> 04:40.330 align:middle line:90%
we do not want the
liability of decrypting that

116
04:40.330 --> 04:42.390 align:middle line:84%
during that session.

117
04:42.390 --> 04:45.860 align:middle line:90%
So in our rules and our
policies for SSL decryption,

118
04:45.860 --> 04:47.600 align:middle line:90%
we could have
categories of URLs,

119
04:47.600 --> 04:50.180 align:middle line:90%
like banking websites,
financial services,

120
04:50.180 --> 04:52.490 align:middle line:90%
and so forth, that
we are not going

121
04:52.490 --> 04:54.500 align:middle line:84%
to decrypt the traffic on.

122
04:54.500 --> 04:57.200 align:middle line:90%
Another example of a
good time to not do this

123
04:57.200 --> 04:59.690 align:middle line:84%
would be medical information.

124
04:59.690 --> 05:02.210 align:middle line:90%
There's huge fines
involved for leaking or not
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
04:59.690 --> 05:02.210 align:middle line:90%
There's huge fines
involved for leaking or not

125
05:02.210 --> 05:04.370 align:middle line:90%
protecting data,
especially personally

126
05:04.370 --> 05:07.350 align:middle line:90%
identifiable information
and medical information.

127
05:07.350 --> 05:10.105 align:middle line:90%
So in our rules
for SSL decryption,

128
05:10.105 --> 05:12.230 align:middle line:90%
we could set up these rules
at the beginning saying

129
05:12.230 --> 05:15.830 align:middle line:90%
don't do any decryption
for these categories

130
05:15.830 --> 05:18.260 align:middle line:90%
or other specific sites
while, at the same time,

131
05:18.260 --> 05:19.910 align:middle line:90%
having some rules
in place that are

132
05:19.910 --> 05:21.890 align:middle line:84%
going to do the SSL decryption.

133
05:21.890 --> 05:24.530 align:middle line:90%
Now, also be aware that if
this firewall Threat Defense

134
05:24.530 --> 05:28.130 align:middle line:90%
appliance is doing SSL/TLS
decryption and re-encryption--

135
05:28.130 --> 05:31.160 align:middle line:84%
that takes a whole bunch of CPU.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
05:28.130 --> 05:31.160 align:middle line:84%
that takes a whole bunch of CPU.

136
05:31.160 --> 05:34.520 align:middle line:90%
So you'd want to make sure
that we have enough horsepower,

137
05:34.520 --> 05:36.740 align:middle line:90%
and we're not just
breaking it by trying

138
05:36.740 --> 05:39.920 align:middle line:90%
to have it do too much
processor-intensive activity

139
05:39.920 --> 05:42.030 align:middle line:90%
above and beyond what
it was designed to do.

140
05:42.030 --> 05:45.590 align:middle line:90%
So if we have a certain flavor
or model of FirePOWER Threat

141
05:45.590 --> 05:47.180 align:middle line:90%
Defense appliance,
perhaps we need

142
05:47.180 --> 05:49.590 align:middle line:90%
to get a bigger one
in order to handle

143
05:49.590 --> 05:51.590 align:middle line:90%
the actual load that we're
going to place on it.

144
05:51.590 --> 05:55.040 align:middle line:90%
Also, this is where a virtual
FirePOWER Threat Defense

145
05:55.040 --> 05:58.160 align:middle line:90%
appliance is a really poor
choice because there just

146
05:58.160 --> 06:01.910 align:middle line:90%
isn't that much CPU available
in a virtualized space
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
05:58.160 --> 06:01.910 align:middle line:90%
isn't that much CPU available
in a virtualized space

147
06:01.910 --> 06:04.910 align:middle line:90%
on that appliance for
thousands and thousands of SSL

148
06:04.910 --> 06:06.800 align:middle line:90%
encryptions and
decryptions that all might

149
06:06.800 --> 06:08.812 align:middle line:84%
need to happen simultaneously.

150
06:08.812 --> 06:10.520 align:middle line:90%
So I'd like to take
a moment and show you

151
06:10.520 --> 06:13.310 align:middle line:90%
where we could go in
the interface on the FMC

152
06:13.310 --> 06:17.540 align:middle line:90%
to both configure an SSL
decryption policy and then how

153
06:17.540 --> 06:20.810 align:middle line:90%
to link that or tie that into
a firewall Threat Defense

154
06:20.810 --> 06:21.710 align:middle line:84%
appliance.

155
06:21.710 --> 06:24.440 align:middle line:90%
So here in the FMC, we're
going to click on Policies.

156
06:24.440 --> 06:27.470 align:middle line:90%
From the dropdown list,
we have an option for SSL.

157
06:27.470 --> 06:30.290 align:middle line:90%
And this is where we would
configure our SSL policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
06:27.470 --> 06:30.290 align:middle line:90%
And this is where we would
configure our SSL policy.

158
06:30.290 --> 06:32.510 align:middle line:90%
This also is going
to assume that we

159
06:32.510 --> 06:36.920 align:middle line:90%
have a certificate or two
lying around with keys in them

160
06:36.920 --> 06:39.440 align:middle line:90%
or a certificate
authority that is trusted

161
06:39.440 --> 06:42.240 align:middle line:90%
by our organization that
can hand out certificates,

162
06:42.240 --> 06:44.000 align:middle line:90%
and we have those
certificates available.

163
06:44.000 --> 06:46.490 align:middle line:90%
So I just created this
little sample SSL policy

164
06:46.490 --> 06:47.870 align:middle line:84%
a few moments ago.

165
06:47.870 --> 06:50.510 align:middle line:90%
And in the policy, we'd
simply create rules.

166
06:50.510 --> 06:52.740 align:middle line:90%
So once we have our
SSL policy in place,

167
06:52.740 --> 06:54.530 align:middle line:90%
including rules
that also include

168
06:54.530 --> 06:58.012 align:middle line:90%
the certificates involved and
the traffic that we do not

169
06:58.012 --> 07:00.470 align:middle line:90%
want to decrypt and the traffic
that we do want to decrypt,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
06:58.012 --> 07:00.470 align:middle line:90%
want to decrypt and the traffic
that we do want to decrypt,

170
07:00.470 --> 07:02.720 align:middle line:90%
and that's all in
place, the next step

171
07:02.720 --> 07:06.310 align:middle line:90%
is to include that as part
of our access control policy.

172
07:06.310 --> 07:08.930 align:middle line:90%
And to do that, we're going
to go back to Policies

173
07:08.930 --> 07:10.700 align:middle line:90%
and then go back
to Access Control.

174
07:10.700 --> 07:12.920 align:middle line:90%
That's our overarching
umbrella of how

175
07:12.920 --> 07:17.390 align:middle line:90%
we implement and enforce most of
our policies here in FirePOWER.

176
07:17.390 --> 07:20.000 align:middle line:90%
So then from here, we can take
our starter policy, our access

177
07:20.000 --> 07:22.678 align:middle line:84%
control policy, click on Edit.

178
07:22.678 --> 07:24.470 align:middle line:90%
And then right here on
this starter policy,

179
07:24.470 --> 07:27.230 align:middle line:84%
we have a link for SSL Policy.

180
07:27.230 --> 07:28.910 align:middle line:90%
And, currently, we
have none assigned.

181
07:28.910 --> 07:32.270 align:middle line:90%
If we wanted to assign an SSL
policy to this access control
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
07:28.910 --> 07:32.270 align:middle line:90%
If we wanted to assign an SSL
policy to this access control

182
07:32.270 --> 07:36.180 align:middle line:90%
policy, we simply click
here where it says None,

183
07:36.180 --> 07:42.370 align:middle line:90%
use the dropdown, select the SSL
policy, and then click on OK.

184
07:42.370 --> 07:46.080 align:middle line:90%
And now we have this SSL policy
associated with this access

185
07:46.080 --> 07:47.230 align:middle line:84%
control policy.

186
07:47.230 --> 07:50.410 align:middle line:90%
So the following steps would be
to save it and then deploy it,

187
07:50.410 --> 07:53.700 align:middle line:90%
so our FirePOWER appliances
could then implement that SSL

188
07:53.700 --> 07:55.060 align:middle line:84%
decryption feature.

189
07:55.060 --> 07:57.300 align:middle line:90%
In this Nugget, we've
identified that, even if users

190
07:57.300 --> 08:01.380 align:middle line:90%
are using HTTPS, the FirePOWER
appliance, based on an SSL
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
07:57.300 --> 08:01.380 align:middle line:90%
are using HTTPS, the FirePOWER
appliance, based on an SSL

191
08:01.380 --> 08:04.770 align:middle line:90%
policy, can decrypt those
sessions and, based on that,

192
08:04.770 --> 08:07.530 align:middle line:90%
have a peek at the
application layer information,

193
08:07.530 --> 08:10.540 align:middle line:90%
so it can go ahead and enforce
the control that we want.

194
08:10.540 --> 08:12.360 align:middle line:90%
I hope this has been
informative for you,

195
08:12.360 --> 08:15.560 align:middle line:90%
and I'd like to thank
you for viewing.