WEBVTT

1
00:00.000 --> 00:07.600
So now that we've talked about what umbrella actually is, how it fits into

2
00:07.600 --> 00:09.840
Cisco's architecture,

3
00:09.840 --> 00:14.800
let's take a look at how we actually integrate this with SDWAN.

4
00:14.800 --> 00:19.400
Now depending on exactly your version of code, this can be either a little bit

5
00:19.400 --> 00:20.140
tricky or

6
00:20.140 --> 00:22.360
it can be really easy.

7
00:22.360 --> 00:24.600
So we're running fairly new code.

8
00:24.600 --> 00:27.940
We'll talk about the versions here in just a minute, but as long as you're

9
00:27.940 --> 00:28.840
running fairly

10
00:28.840 --> 00:32.800
modern code, this is going to be a very easy process.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:28.840 --> 00:32.800
modern code, this is going to be a very easy process.

11
00:32.800 --> 00:35.360
However, we still have to know how to do it.

12
00:35.360 --> 00:37.080
So let's go ahead and jump in.

13
00:37.080 --> 00:40.240
We'll take a look.

14
00:40.240 --> 00:45.780
So the way that we're going to be connecting SDWAN to our SASE, of course,

15
00:45.780 --> 00:46.280
specifically

16
00:46.280 --> 00:50.600
we're talking about umbrella, security on that gateway is we're going to be

17
00:50.600 --> 00:51.400
connecting

18
00:51.400 --> 00:57.090
using IP sec tunnels, the same way that we discussed in previous skills, how we

19
00:57.090 --> 00:57.520
would

20
00:57.520 --> 01:03.250
connect to any other gateway site that we're going to be using for our internet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
00:57.520 --> 01:03.250
connect to any other gateway site that we're going to be using for our internet

21
01:03.250 --> 01:04.280
gateway.

22
01:04.280 --> 01:09.960
Now the cool thing is we actually support automatic tunneling to umbrella.

23
01:09.960 --> 01:17.880
However, in order to do this, we have to have V manage 20 dot five dot one or

24
01:17.880 --> 01:18.800
higher.

25
01:18.800 --> 01:24.730
Now remember in newer versions of code, it's actually SDWAN manager, but

26
01:24.730 --> 01:25.640
regardless of

27
01:25.640 --> 01:31.520
the name, we need to have at least version 20 dot five dot one or up.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
01:25.640 --> 01:31.520
the name, we need to have at least version 20 dot five dot one or up.

28
01:31.520 --> 01:37.960
And for iOS X, it has to be 17 dot two dot one are.

29
01:37.960 --> 01:42.380
So as long as our code is newer than these, which in all honesty are a bit old

30
01:42.380 --> 01:42.920
at this

31
01:42.920 --> 01:43.920
point.

32
01:43.920 --> 01:48.480
So hopefully at the time you're watching this video, you have newer versions of

33
01:48.480 --> 01:48.880
code

34
01:48.880 --> 01:50.240
than this.

35
01:50.240 --> 01:54.800
The other cool thing is they added some other neat features in this code.

36
01:54.800 --> 02:01.190
First, it gives us a way to connect directly and easily to umbrella DNS
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:54.800 --> 02:01.190
First, it gives us a way to connect directly and easily to umbrella DNS

37
02:01.190 --> 02:02.480
security.

38
02:02.480 --> 02:05.480
So they added a quick, easy way to do that.

39
02:05.480 --> 02:11.000
And not only can we connect to umbrella, but they actually gave us the ability

40
02:11.000 --> 02:11.800
to support

41
02:11.800 --> 02:16.520
automatic tunneling also to Z scalar.

42
02:16.520 --> 02:23.450
Z scalar is another company that also offers S a S e services and they have the

43
02:23.450 --> 02:24.600
equivalent

44
02:24.600 --> 02:29.440
of a secure internet gateway along with several other products.

45
02:29.440 --> 02:34.590
But what's cool about this is Cisco added not just support for umbrella, but
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

45
02:29.440 --> 02:34.590
But what's cool about this is Cisco added not just support for umbrella, but

46
02:34.590 --> 02:35.240
also for

47
02:35.240 --> 02:36.480
Z scalar.

48
02:36.480 --> 02:41.120
So you can actually use whichever one works best for your company.

49
02:41.120 --> 02:44.920
Now a couple cool features we support with these tunnels, we can actually

50
02:44.920 --> 02:45.720
configure a

51
02:45.720 --> 02:52.830
tracker to keep track if that interface is up or down so we can verify reach

52
02:52.830 --> 02:52.920
ability.

53
02:52.920 --> 02:57.440
And not that you necessarily need to, but just be aware, we already discussed

54
02:57.440 --> 02:57.960
the fact

55
02:57.960 --> 03:02.120
that these can be automatically configured tunnels, but you can manually
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
02:57.960 --> 03:02.120
that these can be automatically configured tunnels, but you can manually

56
03:02.120 --> 03:02.920
configure them

57
03:02.920 --> 03:04.320
as well.

58
03:04.320 --> 03:08.060
And this would actually be required, of course, if you were using older

59
03:08.060 --> 03:09.800
versions of code.

60
03:09.800 --> 03:13.950
Now you can still do it on today's code, but we generally prefer to go with the

61
03:13.950 --> 03:14.640
automatic

62
03:14.640 --> 03:19.480
option these days since their systems already set up to do it.

63
03:19.480 --> 03:22.920
This integration also supports high availability.

64
03:22.920 --> 03:28.660
We do this very simply by configuring a pair of tunnels so that if one tunnel

65
03:28.660 --> 03:29.720
fails, the

66
03:29.720 --> 03:32.840
other one will hopefully keep operating.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:29.720 --> 03:32.840
other one will hopefully keep operating.

67
03:32.840 --> 03:39.440
Some of the attributes of these tunnels by default, these support up to 250 meg

68
03:39.440 --> 03:39.920
abits

69
03:39.920 --> 03:47.200
per second and you can have up to 50 tunnels per customer.

70
03:47.200 --> 03:51.460
And of course, one advantage of having these multiple tunnels is we can either

71
03:51.460 --> 03:52.120
load share

72
03:52.120 --> 03:54.960
these with equal cost multipath thing.

73
03:54.960 --> 04:00.630
We can do that based on applications or we can just use them for failover like
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
03:54.960 --> 04:00.630
We can do that based on applications or we can just use them for failover like

74
04:00.630 --> 04:01.680
we mentioned

75
04:01.680 --> 04:05.040
up above with the high availability.

76
04:05.040 --> 04:10.330
And the final option, if 250 megabits per second is not enough, you can

77
04:10.330 --> 04:11.560
actually expand

78
04:11.560 --> 04:17.720
this capacity up to 500 megabits per second per tunnel.

79
04:17.720 --> 04:21.700
So now that we've talked about some of the attributes and features of these

80
04:21.700 --> 04:21.920
tunnels,

81
04:21.920 --> 04:26.210
let's jump into SD-WAN manager and take a look at where we would go to actually

82
04:26.210 --> 04:27.000
configure

83
04:27.000 --> 04:28.840
this.

84
04:28.840 --> 04:34.320
So starting off here on the monitor overview page of SD-WAN manager, where we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:28.840 --> 04:34.320
So starting off here on the monitor overview page of SD-WAN manager, where we

85
04:34.320 --> 04:34.800
're going

86
04:34.800 --> 04:38.920
to go to configure this, we're going to go to configuration, then we're going

87
04:38.920 --> 04:39.400
to go to

88
04:39.400 --> 04:45.520
templates under templates, we're going to go to feature templates.

89
04:45.520 --> 04:50.570
Then what we're going to want to do is add a new template under the select

90
04:50.570 --> 04:51.520
device.

91
04:51.520 --> 04:54.630
Since we're going to create this for the catalyst 8000 V, I'm just going to

92
04:54.630 --> 04:55.080
type this

93
04:55.080 --> 04:58.040
in to sort of shorten the list up.

94
04:58.040 --> 05:00.760
And then we'll go ahead and choose that box.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
04:58.040 --> 05:00.760
And then we'll go ahead and choose that box.

95
05:00.760 --> 05:05.540
As soon as we tell it what device it's for, it's going to give us these choices

96
05:05.540 --> 05:06.120
of which

97
05:06.120 --> 05:08.760
template type we want to create.

98
05:08.760 --> 05:13.550
But if we scroll down here a bit to VPN, notice of course there's a bunch of

99
05:13.550 --> 05:14.800
different choices

100
05:14.800 --> 05:19.940
here for the templates, but notice the very first one, the Cisco secure

101
05:19.940 --> 05:21.280
internet gateway

102
05:21.280 --> 05:23.400
or the SIG.

103
05:23.400 --> 05:28.770
If we click on this one, it's going to tell us that in order to do this, we

104
05:28.770 --> 05:29.760
need to create

105
05:29.760 --> 05:32.360
a SIG credentials template.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
05:29.760 --> 05:32.360
a SIG credentials template.

106
05:32.360 --> 05:35.080
Now there's actually two ways is telling us that.

107
05:35.080 --> 05:38.760
First, there's this big banner that comes up right away at the top, telling us

108
05:38.760 --> 05:39.120
that we

109
05:39.120 --> 05:40.680
need the credentials template.

110
05:40.680 --> 05:45.080
Plus, there's a link right down here that we can click on to create it.

111
05:45.080 --> 05:50.070
Now we need this because notice that currently the SIG provider is set to be

112
05:50.070 --> 05:51.040
umbrella.

113
05:51.040 --> 05:54.000
But also remember we mentioned you can do Z scalar.

114
05:54.000 --> 05:58.210
If I click Z scalar here, it doesn't really change anything in that it still

115
05:58.210 --> 05:58.800
wants the

116
05:58.800 --> 06:00.560
credentials template.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
05:58.800 --> 06:00.560
credentials template.

117
06:00.560 --> 06:04.500
Now if we click generic, this doesn't actually use the credentials template

118
06:04.500 --> 06:05.360
because you're

119
06:05.360 --> 06:08.480
going to have to configure that down below.

120
06:08.480 --> 06:11.710
Now this isn't exactly what we're here to look at right now, but just be aware

121
06:11.710 --> 06:12.200
this is

122
06:12.200 --> 06:14.560
an option to look at umbrella.

123
06:14.560 --> 06:17.000
We need to click back on umbrella.

124
06:17.000 --> 06:19.520
And then we're going to have to create this template.

125
06:19.520 --> 06:21.800
Now I don't actually have this set up.

126
06:21.800 --> 06:24.760
So I'm just going to put in my organization ID.

127
06:24.760 --> 06:28.620
And then for the registration key and secret, I'm just going to put in some

128
06:28.620 --> 06:30.280
numbers for now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
06:28.620 --> 06:30.280
numbers for now.

129
06:30.280 --> 06:32.360
Obviously this isn't going to work.

130
06:32.360 --> 06:36.330
So at this point, we're of course not going to actually be able to connect out

131
06:36.330 --> 06:37.240
to umbrella.

132
06:37.240 --> 06:40.080
But let's just go ahead and say save.

133
06:40.080 --> 06:44.880
So even though that's not actually a valid credential, it doesn't know that.

134
06:44.880 --> 06:48.440
So it lets us come in here and see what the rest of this would look like.

135
06:48.440 --> 06:52.640
Now like most things in SD when at this point, we would have to give the

136
06:52.640 --> 06:53.840
template a name so

137
06:53.840 --> 06:59.680
we could call it something like umbrella, give it a description.

138
06:59.680 --> 07:02.650
And if we scroll down and look at the rest of these settings, this is where we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
06:59.680 --> 07:02.650
And if we scroll down and look at the rest of these settings, this is where we

139
07:02.650 --> 07:03.120
can set

140
07:03.120 --> 07:05.640
up things like our tracker.

141
07:05.640 --> 07:09.200
We can actually add a tunnel configuration.

142
07:09.200 --> 07:12.520
This is where we can configure the high availability.

143
07:12.520 --> 07:16.570
And there's some advanced settings here at the bottom where we can configure

144
07:16.570 --> 07:17.320
the umbrella,

145
07:17.320 --> 07:20.160
primary and secondary data centers.

146
07:20.160 --> 07:23.800
So as you can see, there's not really a whole lot to configure here.

147
07:23.800 --> 07:28.870
But this is where we would go to configure our feature template for umbrella to

148
07:28.870 --> 07:29.400
be used

149
07:29.400 --> 07:32.800
as our secure internet gateway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
07:29.400 --> 07:32.800
as our secure internet gateway.

150
07:32.800 --> 07:38.960
So in this video, we talked about how we can tie umbrella into our SD WAN

151
07:38.960 --> 07:40.480
environment.

152
07:40.480 --> 07:45.560
And as we saw, it's as simple as going in and adding a new feature template for

153
07:45.560 --> 07:47.000
our device.

154
07:47.000 --> 07:52.110
And then we choose which type of secure internet gateway we want to connect to

155
07:52.110 --> 07:53.480
either umbrella

156
07:53.480 --> 07:58.260
or zscaler, or of course, there was also a generic option that we would have to

157
07:58.260 --> 07:59.160
completely

158
07:59.160 --> 08:01.120
configure on our own.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
07:59.160 --> 08:01.120
configure on our own.

159
08:01.120 --> 08:08.480
Next, let's take a look at how we can tie all this together with on RAM for Saa

160
08:08.480 --> 08:08.760
S.