WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.580 align:middle line:90%
Another aspect of
secure network design

3
00:02.580 --> 00:04.890 align:middle line:90%
is to be able to control
the traffic once we have

4
00:04.890 --> 00:06.690 align:middle line:90%
a authenticated a
user, controlling

5
00:06.690 --> 00:09.150 align:middle line:90%
what that user is allowed
to do, where they can go,

6
00:09.150 --> 00:09.930 align:middle line:84%
and so forth.

7
00:09.930 --> 00:11.640 align:middle line:90%
And a lot of that
can be accomplished

8
00:11.640 --> 00:13.500 align:middle line:84%
with a next-generation firewall.

9
00:13.500 --> 00:16.380 align:middle line:84%
[MUSIC PLAYING]

10
00:16.380 --> 00:18.790 align:middle line:84%


11
00:18.790 --> 00:20.290 align:middle line:90%
So let's talk about
what that means.

12
00:20.290 --> 00:21.730 align:middle line:90%
What is a
next-generation firewall?

13
00:21.730 --> 00:22.938 align:middle line:84%
Is it referring to Star Trek?

14
00:22.938 --> 00:23.580 align:middle line:84%
No.

15
00:23.580 --> 00:25.038 align:middle line:90%
The next-generation
firewall, which

16
00:25.038 --> 00:27.400 align:middle line:90%
has been out for like a
decade in various forms

17
00:27.400 --> 00:29.200 align:middle line:90%
from various vendors,
has the ability

18
00:29.200 --> 00:31.140 align:middle line:90%
to do more than just
stateful filtering.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:29.200 --> 00:31.140 align:middle line:90%
to do more than just
stateful filtering.

19
00:31.140 --> 00:32.807 align:middle line:90%
Stateful filtering
is when a user

20
00:32.807 --> 00:34.390 align:middle line:90%
on the inside of the
network goes out,

21
00:34.390 --> 00:35.920 align:middle line:90%
and the firewall
remembers who they

22
00:35.920 --> 00:38.180 align:middle line:90%
are as far as their
packets and so forth.

23
00:38.180 --> 00:40.570 align:middle line:90%
And when the replies come
back from the servers,

24
00:40.570 --> 00:42.940 align:middle line:90%
the firewall has statefully
remembered their sessions

25
00:42.940 --> 00:44.860 align:middle line:90%
and dynamically
allows return traffic.

26
00:44.860 --> 00:45.820 align:middle line:84%
Ta-da.

27
00:45.820 --> 00:47.080 align:middle line:84%
Stateful firewalls.

28
00:47.080 --> 00:48.610 align:middle line:84%
But that's not enough anymore.

29
00:48.610 --> 00:50.200 align:middle line:90%
It hasn't been for
a while because we

30
00:50.200 --> 00:52.930 align:middle line:90%
have a lot of traffic that's
happening at the application

31
00:52.930 --> 00:54.550 align:middle line:84%
layer that may be really bad.

32
00:54.550 --> 00:58.720 align:middle line:90%
For example, we could have Bob
that's leaking out information.

33
00:58.720 --> 01:02.290 align:middle line:90%
He's gotten some content that
he shouldn't be sending out,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

33
00:58.720 --> 01:02.290 align:middle line:90%
He's gotten some content that
he shouldn't be sending out,

34
01:02.290 --> 01:04.720 align:middle line:90%
maybe some person-identifiable
information about employees

35
01:04.720 --> 01:08.380 align:middle line:90%
or whatever or company secrets,
and he's sending it out.

36
01:08.380 --> 01:11.062 align:middle line:90%
And we need something-- the
firewall-- to have the ability

37
01:11.062 --> 01:13.645 align:middle line:90%
to take a look at the payload,
regardless of the protocol that

38
01:13.645 --> 01:16.540 align:middle line:90%
is being used, and analyze and
see what is going on there.

39
01:16.540 --> 01:19.000 align:middle line:90%
Or if Bob is going
to websites that

40
01:19.000 --> 01:22.150 align:middle line:90%
wouldn't be in his best interest
or against company policies,

41
01:22.150 --> 01:23.950 align:middle line:90%
a next-generation
firewall has the ability

42
01:23.950 --> 01:26.600 align:middle line:90%
to take a look at the
application layer and say, hey,

43
01:26.600 --> 01:31.090 align:middle line:90%
it's not just TCP, it's not just
TCP port 80 going to a website.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:26.600 --> 01:31.090 align:middle line:90%
it's not just TCP, it's not just
TCP port 80 going to a website.

44
01:31.090 --> 01:33.190 align:middle line:90%
It needs to take a look
and see what that URL is.

45
01:33.190 --> 01:35.130 align:middle line:90%
And even if we
have encryption, we

46
01:35.130 --> 01:37.630 align:middle line:90%
have a next-generation firewall
that can say, you know what?

47
01:37.630 --> 01:40.810 align:middle line:90%
For certain sites, if Bob
is going out with SSL,

48
01:40.810 --> 01:42.610 align:middle line:90%
I'm going to do a
little intercept.

49
01:42.610 --> 01:46.570 align:middle line:90%
I'll have an HTTPS
session between the user

50
01:46.570 --> 01:47.770 align:middle line:84%
and the firewall.

51
01:47.770 --> 01:50.110 align:middle line:90%
That way, the firewall can
look at the naked traffic

52
01:50.110 --> 01:52.720 align:middle line:90%
for a moment, analyze it,
and then send it on its way

53
01:52.720 --> 01:56.290 align:middle line:90%
with another encrypted tunnel or
another encrypted HTTP session

54
01:56.290 --> 01:57.370 align:middle line:84%
going up to the server.

55
01:57.370 --> 01:59.530 align:middle line:90%
The key is that a
next-generation firewall has

56
01:59.530 --> 02:02.470 align:middle line:90%
the ability to do things
like that, like deep packet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
01:59.530 --> 02:02.470 align:middle line:90%
the ability to do things
like that, like deep packet

57
02:02.470 --> 02:06.220 align:middle line:90%
inspection, looking at the
details, analyzing the content,

58
02:06.220 --> 02:08.259 align:middle line:90%
and making decisions,
not just decisions on,

59
02:08.259 --> 02:11.330 align:middle line:90%
hey, that's a bad URL, meaning
it's a risky website or a site

60
02:11.330 --> 02:13.270 align:middle line:90%
you shouldn't be
going to, but also

61
02:13.270 --> 02:15.940 align:middle line:90%
information such as getting
intelligence from the cloud.

62
02:15.940 --> 02:18.640 align:middle line:90%
So a next-generation firewall,
like a Firepower Threat Defense

63
02:18.640 --> 02:21.040 align:middle line:90%
appliance and the
Firepower Management Center

64
02:21.040 --> 02:23.350 align:middle line:90%
that manages the whole thing,
it can get intelligence

65
02:23.350 --> 02:26.560 align:middle line:90%
from the cloud about the
reputation of an IP address

66
02:26.560 --> 02:28.210 align:middle line:84%
or a group of IP addresses.

67
02:28.210 --> 02:30.520 align:middle line:90%
And that way, it can
increase its risk
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:28.210 --> 02:30.520 align:middle line:90%
And that way, it can
increase its risk

68
02:30.520 --> 02:32.870 align:middle line:90%
or increase its
ability to say, you

69
02:32.870 --> 02:35.080 align:middle line:90%
know that might be a bad
idea to go to that site

70
02:35.080 --> 02:37.870 align:middle line:90%
or put up bigger defenses
against those source IP

71
02:37.870 --> 02:40.120 align:middle line:90%
addresses if they're trying
to come into the company

72
02:40.120 --> 02:41.650 align:middle line:84%
from those blocks of addresses.

73
02:41.650 --> 02:44.140 align:middle line:90%
So in the case of
controlling traffic,

74
02:44.140 --> 02:46.540 align:middle line:84%
one aspect is to use firewalls.

75
02:46.540 --> 02:49.030 align:middle line:90%
It is also very important
to analyze that traffic

76
02:49.030 --> 02:51.760 align:middle line:90%
and to control it with
next-generation firewalls.

77
02:51.760 --> 02:55.330 align:middle line:90%
And also with Firepower, there's
also really great IPS as well--

78
02:55.330 --> 02:56.750 align:middle line:84%
intrusion prevention.

79
02:56.750 --> 02:58.750 align:middle line:90%
So as that traffic is
coursing through the veins

80
02:58.750 --> 03:01.600 align:middle line:90%
of the network, we have the
ability to analyze that traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:58.750 --> 03:01.600 align:middle line:90%
of the network, we have the
ability to analyze that traffic

81
03:01.600 --> 03:03.370 align:middle line:90%
and see, hey, is
this harmful traffic.

82
03:03.370 --> 03:04.480 align:middle line:84%
Is this an attack?

83
03:04.480 --> 03:07.090 align:middle line:90%
And to help identify
that before it becomes--

84
03:07.090 --> 03:09.688 align:middle line:90%
or before that traffic gets
too far into our network.

85
03:09.688 --> 03:11.230 align:middle line:90%
So that's one of
the aspects I wanted

86
03:11.230 --> 03:14.140 align:middle line:90%
to share with you in this design
section regarding components

87
03:14.140 --> 03:15.940 align:middle line:90%
of a good design for
security in a network.

88
03:15.940 --> 03:18.430 align:middle line:90%
And that is to have a firewall,
not just any firewall,

89
03:18.430 --> 03:20.980 align:middle line:90%
a next-generation firewall
that can do application layer

90
03:20.980 --> 03:21.910 align:middle line:84%
inspection.

91
03:21.910 --> 03:24.160 align:middle line:90%
It can identify traffic
and permit or deny traffic

92
03:24.160 --> 03:27.130 align:middle line:90%
based on associating a user,
like Bob, with whatever

93
03:27.130 --> 03:28.760 align:middle line:84%
IP address Bob's using.

94
03:28.760 --> 03:30.520 align:middle line:90%
And if we have a
firewall that is allowing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:28.760 --> 03:30.520 align:middle line:90%
And if we have a
firewall that is allowing

95
03:30.520 --> 03:33.100 align:middle line:90%
certain types of
traffic for Bob, how

96
03:33.100 --> 03:34.580 align:middle line:84%
do we keep that traffic secure?

97
03:34.580 --> 03:36.670 align:middle line:90%
And in a larger
environment with lots

98
03:36.670 --> 03:39.318 align:middle line:90%
going on, how do we keep our
security policies straight?

99
03:39.318 --> 03:41.110 align:middle line:90%
Well, there's another
couple set of options

100
03:41.110 --> 03:43.360 align:middle line:90%
I want to share with you
as far as the design goes.

101
03:43.360 --> 03:46.600 align:middle line:90%
And that is a concept
called TrustSec and MACsec.

102
03:46.600 --> 03:48.850 align:middle line:90%
And we'll take a look at
those in the very next video.

103
03:48.850 --> 03:50.140 align:middle line:90%
So I'll see you there
in just a moment.

104
03:50.140 --> 03:52.630 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

105
03:52.630 --> 03:55.920 align:middle line:90%
And I'd like to thank
you for viewing.