WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:02.143 align:middle line:90%
If you've been following
along with this playlist,

3
00:02.143 --> 00:04.650 align:middle line:90%
you learned a lot about
endpoint visibility

4
00:04.650 --> 00:06.498 align:middle line:90%
when we talked about
streaming telemetry.

5
00:06.498 --> 00:08.790 align:middle line:90%
Now what about those remote
clients, though, the people

6
00:08.790 --> 00:10.260 align:middle line:84%
who were working from home?

7
00:10.260 --> 00:14.250 align:middle line:90%
Using AnyConnect, we can
still stream telemetry

8
00:14.250 --> 00:18.060 align:middle line:90%
into a collector that's ready to
receive this data about what's

9
00:18.060 --> 00:20.200 align:middle line:90%
really going on
on that endpoint.

10
00:20.200 --> 00:22.470 align:middle line:90%
And then we can view
and get more visibility

11
00:22.470 --> 00:25.140 align:middle line:90%
into what's going on
within our HQ, as well

12
00:25.140 --> 00:28.520 align:middle line:90%
as our remote offices, using the
AnyConnect Network Visibility

13
00:28.520 --> 00:29.020 align:middle line:84%
Module.

14
00:29.020 --> 00:31.960 align:middle line:90%
Let's talk a little bit
more about how this works.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.020 --> 00:31.960 align:middle line:90%
Let's talk a little bit
more about how this works.

15
00:31.960 --> 00:35.340 align:middle line:90%
Now, the AnyConnect NVM or
Network Visibility Module

16
00:35.340 --> 00:38.520 align:middle line:90%
is a way that we can take
our AnyConnect posture

17
00:38.520 --> 00:41.880 align:middle line:90%
assessment and installation
and turn it up a notch,

18
00:41.880 --> 00:44.700 align:middle line:90%
put it on steroids, because
what we're now doing

19
00:44.700 --> 00:48.480 align:middle line:90%
is basically turning AnyConnect
into a flow collector

20
00:48.480 --> 00:51.990 align:middle line:90%
and sending our NetFlow data
into a different collector,

21
00:51.990 --> 00:54.540 align:middle line:90%
so we can analyze
what type of traffic

22
00:54.540 --> 00:57.870 align:middle line:90%
is exactly happening on
each AnyConnect session.

23
00:57.870 --> 01:00.630 align:middle line:90%
Now here's the thing, when
AnyConnect is working with us,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:57.870 --> 01:00.630 align:middle line:90%
Now here's the thing, when
AnyConnect is working with us,

24
01:00.630 --> 01:04.470 align:middle line:90%
this is basically like an add-on
that we plug in to AnyConnect,

25
01:04.470 --> 01:07.170 align:middle line:90%
so that we can start
collecting NetFlow information

26
01:07.170 --> 01:08.880 align:middle line:90%
and sending it to a
specific collector.

27
01:08.880 --> 01:10.800 align:middle line:90%
And in a lot of cases,
in a lot of ways,

28
01:10.800 --> 01:14.400 align:middle line:90%
they use something like Splunk
to be the NetFlow collector,

29
01:14.400 --> 01:17.070 align:middle line:90%
an analysis tool, but you
could absolutely use something

30
01:17.070 --> 01:20.490 align:middle line:90%
like Cisco's Stealthwatch, so
that way, our remote users, who

31
01:20.490 --> 01:22.890 align:middle line:90%
are accessing our
corporate resources,

32
01:22.890 --> 01:24.990 align:middle line:90%
are now having their
traffic as they're

33
01:24.990 --> 01:26.820 align:middle line:90%
connected to
AnyConnect monitored

34
01:26.820 --> 01:28.710 align:middle line:84%
and streamed into Stealthwatch.

35
01:28.710 --> 01:31.440 align:middle line:90%
And it can use ML,
like Machine Learning,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.710 --> 01:31.440 align:middle line:90%
And it can use ML,
like Machine Learning,

36
01:31.440 --> 01:35.430 align:middle line:90%
or AI detect any anomalies
in how that remote session is

37
01:35.430 --> 01:36.640 align:middle line:84%
actually taking place.

38
01:36.640 --> 01:38.610 align:middle line:90%
A great way that you can
actually get familiar with this

39
01:38.610 --> 01:39.810 align:middle line:84%
is right here on the screen.

40
01:39.810 --> 01:42.510 align:middle line:90%
We actually have the install
and configure components

41
01:42.510 --> 01:43.650 align:middle line:84%
for Splunk.

42
01:43.650 --> 01:46.130 align:middle line:90%
But again, this works just
fine with Stealthwatch.

43
01:46.130 --> 01:47.880 align:middle line:90%
I really prefer this,
though, because it's

44
01:47.880 --> 01:50.460 align:middle line:90%
got a great diagram
right here, so you

45
01:50.460 --> 01:52.720 align:middle line:84%
can see how this really works.

46
01:52.720 --> 01:54.893 align:middle line:90%
We have our end users,
who are teleworking,

47
01:54.893 --> 01:56.310 align:middle line:90%
and they're trying
to connect over

48
01:56.310 --> 01:59.402 align:middle line:90%
the internet into our
firewall via AnyConnect.

49
01:59.402 --> 02:01.860 align:middle line:90%
Of course, the firewall could
be a Firepower Threat Defense
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
01:59.402 --> 02:01.860 align:middle line:90%
Of course, the firewall could
be a Firepower Threat Defense

50
02:01.860 --> 02:03.930 align:middle line:84%
device or an ASA.

51
02:03.930 --> 02:07.500 align:middle line:90%
But then from here, because
we've enabled the AnyConnect

52
02:07.500 --> 02:11.790 align:middle line:90%
connector, the NVM
for Splunk add-on,

53
02:11.790 --> 02:13.740 align:middle line:90%
it allows them to
have the access

54
02:13.740 --> 02:16.260 align:middle line:90%
to the Lan users and
the corporate resources,

55
02:16.260 --> 02:17.850 align:middle line:84%
like the HQ server.

56
02:17.850 --> 02:20.970 align:middle line:90%
But it's also streaming that
flow data into the Splunk

57
02:20.970 --> 02:23.173 align:middle line:90%
collector, so we have
the collector device,

58
02:23.173 --> 02:24.840 align:middle line:90%
and then we actually
have the front end,

59
02:24.840 --> 02:27.360 align:middle line:90%
where we manage and
monitor the NetFlow data.

60
02:27.360 --> 02:31.590 align:middle line:90%
Again, this is just a
component to AnyConnect,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:27.360 --> 02:31.590 align:middle line:90%
Again, this is just a
component to AnyConnect,

61
02:31.590 --> 02:34.110 align:middle line:90%
as well as a component
to whatever your network

62
02:34.110 --> 02:35.670 align:middle line:84%
monitoring solution is.

63
02:35.670 --> 02:38.940 align:middle line:90%
So this is something you can use
in conjunction with AnyConnect,

64
02:38.940 --> 02:42.390 align:middle line:90%
as well as Stealthwatch, so
that you get advanced analytics

65
02:42.390 --> 02:45.600 align:middle line:90%
in understanding what the
infrastructure that we don't

66
02:45.600 --> 02:48.935 align:middle line:90%
control, the remote workers
infrastructure, is really like

67
02:48.935 --> 02:50.310 align:middle line:90%
and what are they
doing when they

68
02:50.310 --> 02:51.810 align:middle line:84%
get connected to AnyConnect.

69
02:51.810 --> 02:55.260 align:middle line:90%
This will help us find
anomalies, like when a username

70
02:55.260 --> 02:58.320 align:middle line:90%
or password gets compromised,
and all of a sudden,

71
02:58.320 --> 02:59.940 align:middle line:90%
we're getting
AnyConnect concessions

72
02:59.940 --> 03:02.740 align:middle line:90%
from one user on a
different end of the world.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:59.940 --> 03:02.740 align:middle line:90%
from one user on a
different end of the world.

73
03:02.740 --> 03:04.410 align:middle line:90%
So maybe my end
user account, I'm

74
03:04.410 --> 03:06.330 align:middle line:90%
connected in from
Louisiana, but then

75
03:06.330 --> 03:09.360 align:middle line:90%
all of a sudden, my credentials
are used to log in from Tokyo.

76
03:09.360 --> 03:11.400 align:middle line:90%
Clearly, there is a
problem going on there.

77
03:11.400 --> 03:14.190 align:middle line:90%
And using Stealthwatch
in conjunction with this,

78
03:14.190 --> 03:15.840 align:middle line:90%
we can catch these
types of things

79
03:15.840 --> 03:17.790 align:middle line:84%
when they happen and stop them.

80
03:17.790 --> 03:20.552 align:middle line:90%
So that's been the AnyConnect
Network Visibility Module.

81
03:20.552 --> 03:22.260 align:middle line:90%
I hope this has been
informative for you.

82
03:22.260 --> 03:24.950 align:middle line:90%
And I'd like to thank
you for viewing.