WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:03.960 align:middle line:90%
By far, Cisco's most popular
VPN product and remote access

3
00:03.960 --> 00:06.000 align:middle line:84%
product is Cisco AnyConnect.

4
00:06.000 --> 00:08.370 align:middle line:90%
If you've used it before,
you know that it's

5
00:08.370 --> 00:09.750 align:middle line:84%
just the best that there is.

6
00:09.750 --> 00:10.470 align:middle line:84%
It's amazing.

7
00:10.470 --> 00:11.220 align:middle line:84%
It's lightweight.

8
00:11.220 --> 00:12.730 align:middle line:84%
It's easy to deploy.

9
00:12.730 --> 00:14.790 align:middle line:90%
It's easy for the end
users to use and get

10
00:14.790 --> 00:16.650 align:middle line:84%
connected into the VPN network.

11
00:16.650 --> 00:19.920 align:middle line:90%
But did you know that it does
a lot more than just tunneling

12
00:19.920 --> 00:22.470 align:middle line:84%
traffic in over DTLS or TLS?

13
00:22.470 --> 00:26.820 align:middle line:90%
It does all sorts of stuff
based on identity authentication

14
00:26.820 --> 00:28.930 align:middle line:84%
and posture assessment--

15
00:28.930 --> 00:29.762 align:middle line:84%
you'll get to see.

16
00:29.762 --> 00:32.220 align:middle line:90%
In this Nugget, we're actually
going to fire up AnyConnect.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.762 --> 00:32.220 align:middle line:90%
In this Nugget, we're actually
going to fire up AnyConnect.

17
00:32.220 --> 00:34.800 align:middle line:90%
I'm going to show you where you
can get AnyConnect installed

18
00:34.800 --> 00:37.650 align:middle line:90%
on your computer and see all
the different features about it.

19
00:37.650 --> 00:39.870 align:middle line:90%
And we'll talk
about how AnyConnect

20
00:39.870 --> 00:42.630 align:middle line:90%
allows us to perform
several different tasks,

21
00:42.630 --> 00:45.180 align:middle line:90%
like identity-based
authentication, as well as

22
00:45.180 --> 00:46.170 align:middle line:84%
posture assessment.

23
00:46.170 --> 00:47.160 align:middle line:84%
Let's get going.

24
00:47.160 --> 00:49.210 align:middle line:90%
Look, AnyConnect is
a really big deal.

25
00:49.210 --> 00:51.240 align:middle line:90%
I'm speaking from
professional experience

26
00:51.240 --> 00:53.880 align:middle line:90%
here without any other
motivation behind me

27
00:53.880 --> 00:58.320 align:middle line:90%
when I say that I have yet to
find another VPN remote access

28
00:58.320 --> 01:02.130 align:middle line:90%
VPN solution that's as pleasant
to work with than AnyConnect.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.320 --> 01:02.130 align:middle line:90%
VPN solution that's as pleasant
to work with than AnyConnect.

29
01:02.130 --> 01:05.370 align:middle line:90%
And while the deployment may be
a little trickier than normal,

30
01:05.370 --> 01:09.300 align:middle line:90%
it's so incredibly powerful,
yet, so incredibly lightweight

31
01:09.300 --> 01:11.610 align:middle line:90%
for end users to work
with that it's just

32
01:11.610 --> 01:14.670 align:middle line:90%
the preferred solution
when it comes to VPNs.

33
01:14.670 --> 01:19.200 align:middle line:90%
But allowing people into our
network from the outside--

34
01:19.200 --> 01:21.510 align:middle line:84%
that poses a lot more risk.

35
01:21.510 --> 01:24.930 align:middle line:90%
But that's why AnyConnect
is so incredibly powerful.

36
01:24.930 --> 01:26.910 align:middle line:90%
Most people have
only worked with it

37
01:26.910 --> 01:28.020 align:middle line:84%
to connect to a network.

38
01:28.020 --> 01:32.280 align:middle line:90%
But did you know how much extra
stuff AnyConnect can really do?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.020 --> 01:32.280 align:middle line:90%
But did you know how much extra
stuff AnyConnect can really do?

39
01:32.280 --> 01:35.500 align:middle line:90%
That's what this Nugget in
the next Nugget are all about.

40
01:35.500 --> 01:38.460 align:middle line:90%
So let's first talk about
how the authentication takes

41
01:38.460 --> 01:39.463 align:middle line:84%
place within AnyConnect.

42
01:39.463 --> 01:41.130 align:middle line:90%
And then the next
Nugget, we'll actually

43
01:41.130 --> 01:43.630 align:middle line:90%
talk about posture
assessment itself.

44
01:43.630 --> 01:48.460 align:middle line:90%
So you've deployed a shiny
new Cisco firewall appliance.

45
01:48.460 --> 01:51.240 align:middle line:90%
Now, these appliances are
really for AnyConnect,

46
01:51.240 --> 01:52.530 align:middle line:84%
they come in two flavors.

47
01:52.530 --> 01:56.160 align:middle line:90%
They're the Firepower
Threat Defense device,

48
01:56.160 --> 01:58.200 align:middle line:84%
or they're the Cisco ASA.

49
01:58.200 --> 02:00.510 align:middle line:90%
Traditionally, you
hear about AnyConnect
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:58.200 --> 02:00.510 align:middle line:90%
Traditionally, you
hear about AnyConnect

50
02:00.510 --> 02:02.460 align:middle line:84%
deployed via the ASA.

51
02:02.460 --> 02:04.740 align:middle line:90%
But know that the Firepower
Threat device can also

52
02:04.740 --> 02:05.890 align:middle line:84%
handle the same thing.

53
02:05.890 --> 02:08.639 align:middle line:90%
And, of course, Firepower
Threat devices in groups

54
02:08.639 --> 02:11.039 align:middle line:90%
can be managed by Firepower
Management Center.

55
02:11.039 --> 02:12.810 align:middle line:90%
Just think about
the full picture

56
02:12.810 --> 02:15.553 align:middle line:90%
when it comes to working
with Cisco AnyConnect.

57
02:15.553 --> 02:17.220 align:middle line:90%
But when we're talking
about AnyConnect,

58
02:17.220 --> 02:20.010 align:middle line:90%
we're talking about
remote access VPNs

59
02:20.010 --> 02:23.340 align:middle line:90%
and allowing in-users
out there in the world

60
02:23.340 --> 02:27.540 align:middle line:90%
on the internet who are shopping
on Amazon and watching Netflix.

61
02:27.540 --> 02:30.900 align:middle line:90%
We're allowing these
people into the firewall
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:27.540 --> 02:30.900 align:middle line:90%
We're allowing these
people into the firewall

62
02:30.900 --> 02:35.280 align:middle line:90%
and then on the inside of
the network, not necessarily

63
02:35.280 --> 02:37.110 align:middle line:84%
accessing whatever they want.

64
02:37.110 --> 02:40.260 align:middle line:90%
That's where AnyConnect
and AAA services

65
02:40.260 --> 02:41.730 align:middle line:84%
start to come into play.

66
02:41.730 --> 02:43.950 align:middle line:90%
Yeah, of course, the
default configuration

67
02:43.950 --> 02:46.830 align:middle line:90%
is we can say Bob
down here connects

68
02:46.830 --> 02:50.370 align:middle line:90%
in through the internet
into Firepower or the ASA.

69
02:50.370 --> 02:53.100 align:middle line:90%
They get placed
into a special pool

70
02:53.100 --> 02:55.350 align:middle line:90%
of IP addresses
specifically reserved

71
02:55.350 --> 02:56.980 align:middle line:84%
for AnyConnect clients.

72
02:56.980 --> 02:59.370 align:middle line:90%
Of course, I have to spell
AnyConnect correctly.

73
02:59.370 --> 03:02.100 align:middle line:90%
And now Bob has made his
way into the AnyConnect
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:59.370 --> 03:02.100 align:middle line:90%
And now Bob has made his
way into the AnyConnect

74
03:02.100 --> 03:03.180 align:middle line:84%
pool of IP addresses.

75
03:03.180 --> 03:06.360 align:middle line:90%
From here, we can say if
any of these IP addresses

76
03:06.360 --> 03:09.090 align:middle line:90%
can allow access
to other sources.

77
03:09.090 --> 03:12.420 align:middle line:90%
Or we could control that
access at the user level.

78
03:12.420 --> 03:15.540 align:middle line:90%
But the big thing is that
when Bob goes to connect

79
03:15.540 --> 03:17.850 align:middle line:90%
and he reaches this
point of the firewall,

80
03:17.850 --> 03:19.890 align:middle line:84%
the firewall says hold up, Bob.

81
03:19.890 --> 03:23.010 align:middle line:90%
We need to make sure you're
really who you say you are.

82
03:23.010 --> 03:25.530 align:middle line:90%
So if I clear the screen
for just a moment,

83
03:25.530 --> 03:27.215 align:middle line:84%
it looks like this.

84
03:27.215 --> 03:29.340 align:middle line:90%
We're going to bring
AnyConnect up onto the screen.

85
03:29.340 --> 03:31.215 align:middle line:90%
And this is where I'm
trying to get connected
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:29.340 --> 03:31.215 align:middle line:90%
And this is where I'm
trying to get connected

86
03:31.215 --> 03:33.510 align:middle line:90%
into that DevNet
Sandbox instance we

87
03:33.510 --> 03:35.520 align:middle line:84%
saw just a couple Nuggets ago.

88
03:35.520 --> 03:37.200 align:middle line:84%
I'm going to click Connect here.

89
03:37.200 --> 03:39.930 align:middle line:90%
And it says we're trying to
contact this specific endpoint.

90
03:39.930 --> 03:43.390 align:middle line:90%
And you can see it's prompting
me for a username and password.

91
03:43.390 --> 03:46.290 align:middle line:90%
So I'm going to paste my
password in right here

92
03:46.290 --> 03:47.610 align:middle line:84%
and click OK.

93
03:47.610 --> 03:50.798 align:middle line:90%
It establishes the VPN
section, and there we go.

94
03:50.798 --> 03:52.590 align:middle line:90%
I'm going to bring
AnyConnect back up here.

95
03:52.590 --> 03:54.632 align:middle line:90%
And you can see now I've
got the green checkmark.

96
03:54.632 --> 03:56.580 align:middle line:90%
And it's showing me
as I'm connected.

97
03:56.580 --> 03:58.702 align:middle line:90%
Now, if I shrink AnyConnect
down a little bit

98
03:58.702 --> 04:00.660 align:middle line:90%
to fit on the screen, I
actually got to move it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:58.702 --> 04:00.660 align:middle line:90%
to fit on the screen, I
actually got to move it

99
04:00.660 --> 04:01.620 align:middle line:84%
because I can't shrink it.

100
04:01.620 --> 04:03.180 align:middle line:90%
There's a little gear
here at the bottom that

101
04:03.180 --> 04:05.100 align:middle line:90%
tells you all the
statistics and what's

102
04:05.100 --> 04:07.230 align:middle line:84%
going on behind the scenes.

103
04:07.230 --> 04:11.100 align:middle line:90%
You can see right here,
this client IPv6 address,

104
04:11.100 --> 04:12.990 align:middle line:84%
192.168.102.

105
04:12.990 --> 04:16.060 align:middle line:90%
That's the IP address I was
given when I got connected.

106
04:16.060 --> 04:19.440 align:middle line:90%
And this is what's allowing me
to access the resources that

107
04:19.440 --> 04:23.520 align:middle line:90%
are here in the DevNet Sandbox
on this 10.10.20 subnet.

108
04:23.520 --> 04:26.490 align:middle line:90%
You see, my subnet here
that I've been assigned to

109
04:26.490 --> 04:30.120 align:middle line:90%
and my user account have been
explicitly permitted in order
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:26.490 --> 04:30.120 align:middle line:90%
and my user account have been
explicitly permitted in order

110
04:30.120 --> 04:31.720 align:middle line:84%
to access these credentials.

111
04:31.720 --> 04:34.290 align:middle line:90%
Now, how did all of this
authentication really

112
04:34.290 --> 04:35.310 align:middle line:84%
take place?

113
04:35.310 --> 04:38.820 align:middle line:90%
I can't say for sure because I'm
not the architect of the DevNet

114
04:38.820 --> 04:39.450 align:middle line:84%
Sandbox.

115
04:39.450 --> 04:41.730 align:middle line:84%
But if I had to guess when me--

116
04:41.730 --> 04:43.110 align:middle line:84%
I'm going to put Knox here--

117
04:43.110 --> 04:45.150 align:middle line:90%
attempted to get
connected to AnyConnect,

118
04:45.150 --> 04:48.840 align:middle line:90%
I ran into either a Firepower
Threat device or an ASA

119
04:48.840 --> 04:49.680 align:middle line:84%
appliance.

120
04:49.680 --> 04:51.750 align:middle line:90%
And then from here,
my credentials

121
04:51.750 --> 04:55.620 align:middle line:90%
were authenticated against
an identity data store.

122
04:55.620 --> 04:59.730 align:middle line:90%
This could be something
like ISE or NPS or ACS.

123
04:59.730 --> 05:03.180 align:middle line:90%
And it could have even
proxy using RADIUS or TACACS
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
04:59.730 --> 05:03.180 align:middle line:90%
And it could have even
proxy using RADIUS or TACACS

124
05:03.180 --> 05:05.280 align:middle line:90%
against an Active
Directory profile.

125
05:05.280 --> 05:07.800 align:middle line:90%
The point is, is I
typed in my username.

126
05:07.800 --> 05:10.560 align:middle line:90%
And I provided my randomly
generated password

127
05:10.560 --> 05:11.940 align:middle line:84%
that they emailed to me.

128
05:11.940 --> 05:14.640 align:middle line:90%
It got authenticated
off of this data store.

129
05:14.640 --> 05:22.545 align:middle line:90%
And it told the firewall here,
placed them in the 192.168.102

130
05:22.545 --> 05:24.690 align:middle line:84%
dot whatever subnet.

131
05:24.690 --> 05:27.090 align:middle line:90%
And that subnet in
this specific case

132
05:27.090 --> 05:30.570 align:middle line:90%
was given access to
my ISE environment
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
05:27.090 --> 05:30.570 align:middle line:90%
was given access to
my ISE environment

133
05:30.570 --> 05:33.670 align:middle line:90%
that I'm trying to work
with right now in the DevNet

134
05:33.670 --> 05:34.360 align:middle line:84%
Sandbox.

135
05:34.360 --> 05:37.530 align:middle line:90%
Now, you may be thinking to
yourself, how can I download

136
05:37.530 --> 05:39.330 align:middle line:84%
AnyConnect and follow along?

137
05:39.330 --> 05:42.070 align:middle line:90%
How can I see how
this really works?

138
05:42.070 --> 05:45.150 align:middle line:90%
And that's really the beauty
of the DevNet sandboxes

139
05:45.150 --> 05:47.100 align:middle line:90%
that we now have
all of these tools

140
05:47.100 --> 05:48.700 align:middle line:84%
that we can experiment with.

141
05:48.700 --> 05:51.741 align:middle line:90%
So if you go to
devnetsandbox.cisco.com,

142
05:51.741 --> 05:54.360 align:middle line:90%
let me walk you through the
process of how I actually

143
05:54.360 --> 05:55.140 align:middle line:84%
got here.

144
05:55.140 --> 05:57.780 align:middle line:90%
If I go to Sandbox Labs
right here at the top,

145
05:57.780 --> 06:02.250 align:middle line:90%
this shows you every single type
of sandbox and Cisco appliance
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
05:57.780 --> 06:02.250 align:middle line:90%
this shows you every single type
of sandbox and Cisco appliance

146
06:02.250 --> 06:03.330 align:middle line:84%
that you can work with.

147
06:03.330 --> 06:05.220 align:middle line:90%
And what you're really
looking for here

148
06:05.220 --> 06:07.440 align:middle line:84%
is anything that says reserve.

149
06:07.440 --> 06:10.380 align:middle line:90%
So in my case, since I wanted
to work with Identity Services

150
06:10.380 --> 06:14.040 align:middle line:90%
Engine, I filtered my
categories down to security.

151
06:14.040 --> 06:18.210 align:middle line:90%
And then I found the Identity
Services Engine with mud.

152
06:18.210 --> 06:21.142 align:middle line:90%
That's this one, and I
clicked the RESERVE button.

153
06:21.142 --> 06:22.600 align:middle line:90%
So if you click
the RESERVE button,

154
06:22.600 --> 06:24.360 align:middle line:90%
you'll get this cool
little pop-up here.

155
06:24.360 --> 06:27.390 align:middle line:90%
And it asks you how long do
you want to reserve this for?

156
06:27.390 --> 06:30.870 align:middle line:90%
Now, eight hours is a really
long time to reserve a sandbox.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
06:27.390 --> 06:30.870 align:middle line:90%
Now, eight hours is a really
long time to reserve a sandbox.

157
06:30.870 --> 06:33.540 align:middle line:90%
If you don't need eight hours
on the sic, because remember,

158
06:33.540 --> 06:35.830 align:middle line:90%
if you reserve this,
nobody else can use it.

159
06:35.830 --> 06:38.080 align:middle line:90%
So you're hogging
it the whole time.

160
06:38.080 --> 06:40.380 align:middle line:90%
So if you don't need
eight hours on a sandbox,

161
06:40.380 --> 06:42.510 align:middle line:90%
click the little
pencil here and choose

162
06:42.510 --> 06:45.330 align:middle line:90%
something more like one
hour-- something small.

163
06:45.330 --> 06:46.770 align:middle line:90%
When you click the
RESERVE button,

164
06:46.770 --> 06:50.610 align:middle line:90%
it will spin up that instance
for you in email, the username

165
06:50.610 --> 06:51.840 align:middle line:84%
and password to you.

166
06:51.840 --> 06:54.300 align:middle line:90%
Then you can go into
the sandbox itself

167
06:54.300 --> 06:56.550 align:middle line:90%
while it's being
created and activated.

168
06:56.550 --> 07:00.840 align:middle line:90%
And under the VPN Access Section
right here, this tab, this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
06:56.550 --> 07:00.840 align:middle line:90%
And under the VPN Access Section
right here, this tab, this

169
07:00.840 --> 07:04.290 align:middle line:90%
is where you can download the
Cisco AnyConnect VPN Client

170
07:04.290 --> 07:05.160 align:middle line:84%
software.

171
07:05.160 --> 07:06.810 align:middle line:84%
That's what you want to do.

172
07:06.810 --> 07:08.652 align:middle line:84%
It's a very basic installation.

173
07:08.652 --> 07:10.110 align:middle line:90%
And the next thing
you know, you've

174
07:10.110 --> 07:13.080 align:middle line:90%
got the Cisco AnyConnect
Secure Mobility Client

175
07:13.080 --> 07:14.430 align:middle line:84%
installed in your computer.

176
07:14.430 --> 07:17.460 align:middle line:90%
And you can get tested
connecting to the AnyConnect

177
07:17.460 --> 07:20.370 align:middle line:90%
instance once they email
you your username, password,

178
07:20.370 --> 07:21.810 align:middle line:84%
and URL to get connected to.

179
07:21.810 --> 07:23.940 align:middle line:90%
Now, the really cool thing
about Cisco AnyConnect

180
07:23.940 --> 07:27.450 align:middle line:90%
in this specific installation
that they've provided us here

181
07:27.450 --> 07:30.720 align:middle line:90%
is that it does a whole
heck of a lot more than just
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
07:27.450 --> 07:30.720 align:middle line:90%
is that it does a whole
heck of a lot more than just

182
07:30.720 --> 07:33.030 align:middle line:90%
authenticate your
username and password.

183
07:33.030 --> 07:35.850 align:middle line:90%
You're seeing all of these other
things that are listed here--

184
07:35.850 --> 07:39.907 align:middle line:90%
Roaming Security, AMP Enabler,
Systems Scan, Web Security.

185
07:39.907 --> 07:42.240 align:middle line:90%
That's what we're going to
talk about in the next Nugget

186
07:42.240 --> 07:45.000 align:middle line:90%
when we start talking
about posture assessment.

187
07:45.000 --> 07:47.070 align:middle line:90%
And I'm really excited
to talk about it.

188
07:47.070 --> 07:49.260 align:middle line:90%
But this is one way
that you should consider

189
07:49.260 --> 07:52.410 align:middle line:90%
how remote access VPNs
work and how they can

190
07:52.410 --> 07:55.170 align:middle line:90%
and how we can authenticate
in users, as they

191
07:55.170 --> 07:58.290 align:middle line:90%
try to get brought into
the network using a tool,

192
07:58.290 --> 08:02.640 align:middle line:90%
like Cisco, ISE, or the older
ACS or even Windows Server NPS
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
07:58.290 --> 08:02.640 align:middle line:90%
like Cisco, ISE, or the older
ACS or even Windows Server NPS

193
08:02.640 --> 08:03.310 align:middle line:84%
products.

194
08:03.310 --> 08:05.018 align:middle line:90%
I hope this has been
informative for you,

195
08:05.018 --> 08:07.280 align:middle line:90%
and I'd like to thank
you for viewing.