WEBVTT 1 00:00.000 --> 00:04.240 So as we begin our discussion of the beautiful tool called 40 Analyzer, let's 2 00:04.240 --> 00:05.440 also take a minute 3 00:05.440 --> 00:08.800 and let me review this topology with you which we'll be using throughout this 4 00:08.800 --> 00:10.080 course. So here I've 5 00:10.080 --> 00:14.980 got four firewalls or 440 gates. I've got one called HQ firewall one right here 6 00:14.980 --> 00:15.760 . I've got one 7 00:15.760 --> 00:19.990 called HQ firewall two right here one called HQ firewall three right there. And 8 00:19.990 --> 00:20.480 over here I have 9 00:20.480 --> 00:24.260 a branch firewall and it also has an HA pair which I think at the moment maybe 10 00:24.260 --> 00:25.760 offline but in any case 11 00:25.760 --> 00:29.000 I've got a firewall here at the branch office as well. Now for instructions on 12 00:29.000 --> 00:29.840 how to configure the 13 00:29.840 --> 00:33.570 40 gates themselves and configure them and their policies. We have separate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 13 00:29.840 --> 00:33.570 40 gates themselves and configure them and their policies. We have separate 14 00:33.570 --> 00:34.560 content here at CBT 15 00:34.560 --> 00:39.120 nuggets on that topic as well. And as we continue together in this 40 analyzer 16 00:39.120 --> 00:39.840 course we're going 17 00:39.840 --> 00:43.430 to be focusing on the integration of the use of this tool right here called 40 18 00:43.430 --> 00:44.560 Analyzer. So let's 19 00:44.560 --> 00:48.140 begin with the purpose. Why would we even want to have this device called 40 20 00:48.140 --> 00:49.200 Analyzer? Well one of 21 00:49.200 --> 00:53.870 the main benefits of having a 40 Analyzer it can act as a central clearing 22 00:53.870 --> 00:54.960 house for all of our 23 00:54.960 --> 00:58.920 log information coming from not just 40 gate firewalls but also lots of 24 00:58.920 --> 01:00.960 different for net devices. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 24 00:58.920 --> 01:00.960 different for net devices. So 25 01:00.960 --> 01:06.040 we're all right out centralized logs and that way you and I we can log in to 40 26 01:06.040 --> 01:07.200 Analyzer and they'll 27 01:07.200 --> 01:10.890 have those logs from all of our devices. So we have a single pane of glass 28 01:10.890 --> 01:12.240 where we can look at and 29 01:12.240 --> 01:16.160 analyze and do investigations regarding all the log messages coming from our 30 01:16.160 --> 01:17.440 for net devices. Now 31 01:17.440 --> 01:21.240 in order to get those logs from these devices over to the 40 Analyzer we're 32 01:21.240 --> 01:21.840 going to do a couple 33 01:21.840 --> 01:25.350 things. Number one we're going to register our devices for example firewall two 34 01:25.350 --> 01:26.320 firewall three 35 01:26.320 --> 01:30.460 firewall one the branch firewall will register all those with the 40 Analyzer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 35 01:26.320 --> 01:30.460 firewall one the branch firewall will register all those with the 40 Analyzer 36 01:30.460 --> 01:31.280 and that way not 37 01:31.280 --> 01:34.640 just any device can go ahead and send logs they'll have to be registered where 38 01:34.640 --> 01:35.600 the 40 Analyzer is 39 01:35.600 --> 01:39.680 accepting those log messages and then at the 40 Analyzer it can buffer and 40 01:39.680 --> 01:40.880 organize and keep all 41 01:40.880 --> 01:44.370 that information regarding the logs and then what we can do so this is us right 42 01:44.370 --> 01:44.960 here. Us as 43 01:44.960 --> 01:47.920 administrators can then go ahead and log in to 40 Analyzer to do the 44 01:47.920 --> 01:49.200 investigation we can view 45 01:49.200 --> 01:53.280 and search the logs we can drill down into the details and also create reports 46 01:53.280 --> 01:54.080 instead of automated 47 01:54.080 --> 01:57.210 reports regarding what's happening in our environment. And one of the major 48 01:57.210 --> 01:58.240 benefits of having all that 49 01:58.240 --> 02:01.380 data right here is that we can then correlate different events that are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 49 01:58.240 --> 02:01.380 data right here is that we can then correlate different events that are 50 02:01.380 --> 02:02.400 happening across different 51 02:02.400 --> 02:06.230 devices to help identify what's really happening on the network. For example do 52 02:06.230 --> 02:07.360 we have a virus or 53 02:07.360 --> 02:11.390 some malware or some other activity where it's being seen by multiple devices 54 02:11.390 --> 02:12.080 we can then 55 02:12.080 --> 02:15.810 collect all that and analyze it right here at the 40 Analyzer. So the types of 56 02:15.810 --> 02:16.800 information logs 57 02:16.800 --> 02:19.940 that we're going to have here are going to include things such as security 58 02:19.940 --> 02:21.280 events things like malware 59 02:21.280 --> 02:24.520 showing up or denial of service attacks or some other intrusion prevention 60 02:24.520 --> 02:25.440 related activities 61 02:25.440 --> 02:29.410 as well as system events for example configurations being changed on our 62 02:29.410 --> 02:31.040 devices or who logged on who WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 62 02:29.410 --> 02:31.040 devices or who logged on who 63 02:31.040 --> 02:35.490 logged off as well as traffic logs all of that can be contained here at the 40 64 02:35.490 --> 02:36.640 Analyzer. Now behind 65 02:36.640 --> 02:40.440 the scenes the 40 Analyzer is going to use a structured query language database 66 02:40.440 --> 02:41.280 and that's spelled 67 02:41.280 --> 02:46.280 SQL and you can either spell it out like that SQL or it can say SQL and SQL 68 02:46.280 --> 02:47.840 stands for structured 69 02:47.840 --> 02:51.680 query language. So behind the scenes 40 Analyzer is taking all that data coming 70 02:51.680 --> 02:52.320 in putting into 71 02:52.320 --> 02:55.470 this database the SQL database and then when you and I connect to and log into 72 02:55.470 --> 02:56.480 the 40 Analyzer it 73 02:56.480 --> 02:59.800 can present that information in nice easy format for us including generating 74 02:59.800 --> 03:00.560 reports but again WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 74 02:59.800 --> 03:00.560 reports but again 75 03:00.560 --> 03:04.370 behind the scenes it was using SQL and that type of database to keep track and 76 03:04.370 --> 03:05.360 organize everything. 77 03:05.360 --> 03:09.300 And there's many different types of SQL databases and on the 40 Analyzer the 78 03:09.300 --> 03:10.240 one they use is right 79 03:10.240 --> 03:14.720 here. So a person doesn't have to be an expert at SQL however for some of the 80 03:14.720 --> 03:15.520 advanced reporting 81 03:15.520 --> 03:19.170 capabilities if you're familiar with SQL and how it works it would be easier to 82 03:19.170 --> 03:19.840 generate some of 83 03:19.840 --> 03:23.470 those reports. So make the notice a little bit and let's talk about a few other 84 03:23.470 --> 03:24.080 benefits and 85 03:24.080 --> 03:27.690 functions of 40 Analyzer. So let me go ahead and clean this up a little bit and 86 03:27.690 --> 03:28.320 let's chat about 87 03:28.320 --> 03:31.760 some of the other fundamentals regarding 40 Analyzer. There's two different WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 87 03:28.320 --> 03:31.760 some of the other fundamentals regarding 40 Analyzer. There's two different 88 03:31.760 --> 03:32.800 operating modes that a 89 03:32.800 --> 03:37.800 40 Analyzer can operate in and the default one is Analyzer and when the 40 90 03:37.800 --> 03:39.280 Analyzer is in Analyzer 91 03:39.280 --> 03:42.520 mode it's going to act just as we discussed where we have different devices 92 03:42.520 --> 03:43.920 that have registered 93 03:43.920 --> 03:47.720 with that 40 Analyzer. All that log and event information is being sent over 94 03:47.720 --> 03:48.160 and then you and 95 03:48.160 --> 03:51.490 I log into the 40 Analyzer to see all the details. So with Analyzer mode 96 03:51.490 --> 03:52.640 devices are sending their 97 03:52.640 --> 03:56.840 logs directly to the 40 Analyzer. Now the other mode is called collector mode 98 03:56.840 --> 03:57.840 and think of a 40 99 03:57.840 --> 04:01.300 Analyzer in collector mode is like being a middleman. So let's imagine we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 99 03:57.840 --> 04:01.300 Analyzer in collector mode is like being a middleman. So let's imagine we have 100 04:01.300 --> 04:02.720 a 40 gate firewall here 101 04:02.720 --> 04:07.300 that's forwarding its logs over to a collector really it's a 40 Analyzer that's 102 04:07.300 --> 04:08.240 in collector mode 103 04:08.240 --> 04:12.800 so I'll put FAZ here in collector mode and then the collector can then forward 104 04:12.800 --> 04:13.840 those over to another 105 04:13.840 --> 04:18.210 40 Analyzer that's operating in Analyzer mode and it's really simple to flip 106 04:18.210 --> 04:19.280 the switch to tell the 107 04:19.280 --> 04:23.420 40 Analyzer to be in collector mode or Analyzer mode and in small environments 108 04:23.420 --> 04:24.320 we're going to just 109 04:24.320 --> 04:27.820 skip the middleman and have our 40 gates and other 4-net devices send their 110 04:27.820 --> 04:28.880 information directly to 111 04:28.880 --> 04:32.570 the 40 Analyzer but in a bigger environment with wide area networking as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 111 04:28.880 --> 04:32.570 the 40 Analyzer but in a bigger environment with wide area networking as 112 04:32.570 --> 04:33.680 possible we may want to 113 04:33.680 --> 04:37.870 use multiple collectors who then forward it to our 40 Analyzers and if so that 114 04:37.870 --> 04:38.960 would be the hierarchy 115 04:38.960 --> 04:42.970 right here. 40 gates and other 4-net devices sending them to the collector and 116 04:42.970 --> 04:43.760 then the collectors 117 04:43.760 --> 04:47.290 forwarding them to the 40 Analyzer. Now one thing to be aware of regarding a 40 118 04:47.290 --> 04:48.400 Analyzer in collector 119 04:48.400 --> 04:53.010 mode is that we cannot at that device generate your ports and dig into the 120 04:53.010 --> 04:54.400 details we can only do 121 04:54.400 --> 04:58.340 that in a 40 Analyzer that set up in Analyzer mode. Now another aspect that we 122 04:58.340 --> 04:59.680 want to be aware of 123 04:59.680 --> 05:03.960 is a really cool feature inside of 4-net with 40 gates called a security fabric WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 123 04:59.680 --> 05:03.960 is a really cool feature inside of 4-net with 40 gates called a security fabric 124 05:03.960 --> 05:04.960 . So let's imagine 125 05:04.960 --> 05:10.310 that this firewall firewall 1 and firewall 2 and firewall 3 are all part of the 126 05:10.310 --> 05:11.520 same security fabric. 127 05:11.520 --> 05:15.420 Now in the security fabric let's also imagine that all three are sending their 128 05:15.420 --> 05:16.480 login information 129 05:16.480 --> 05:20.450 over to the 40 Analyzer. Now if this Windows computer right here or this PC 130 05:20.450 --> 05:21.680 right here has 131 05:21.680 --> 05:25.410 some event that happens and that traffic is for example going out to the public 132 05:25.410 --> 05:26.160 internet that 133 05:26.160 --> 05:31.040 traffic would go through firewall 2 and through firewall 1 and one would think WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 133 05:26.160 --> 05:31.040 traffic would go through firewall 2 and through firewall 1 and one would think 134 05:31.040 --> 05:31.600 well we're going 135 05:31.600 --> 05:35.570 to have duplicate logs but fortunately on the 40 Analyzer if we have this 40 136 05:35.570 --> 05:36.720 gate security fabric 137 05:36.720 --> 05:40.970 here the 40 Analyzer realizes those are all part of the same security fabric 138 05:40.970 --> 05:41.920 and it's going to help 139 05:41.920 --> 05:46.160 reduce the duplicates regarding the logging. Also not every firewall has the 140 05:46.160 --> 05:47.040 same rules some 141 05:47.040 --> 05:51.160 firewalls may be focused on denial of service attacks other firewalls may be 142 05:51.160 --> 05:52.800 focused on authentication 143 05:52.800 --> 05:56.400 and network address translation. So the cool thing is because the 40 Analyzer 144 05:56.400 --> 05:56.960 is also from 145 05:56.960 --> 06:01.350 4-net it understands the security fabric it's going to help reduce duplicate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 145 05:56.960 --> 06:01.350 4-net it understands the security fabric it's going to help reduce duplicate 146 06:01.350 --> 06:02.160 log messages 147 06:02.160 --> 06:05.490 if it's showing the same information and that way of the best of both worlds we 148 06:05.490 --> 06:06.080 can get the logs 149 06:06.080 --> 06:09.270 and security events regarding traffic that's going through and we don't have to 150 06:09.270 --> 06:09.760 worry about a 151 06:09.760 --> 06:13.660 bunch of duplicate logs regarding the exact same traffic flow or the exact same 152 06:13.660 --> 06:14.080 events. 153 06:14.080 --> 06:17.860 And while we're talking about fabric let's also chat about another concept 154 06:17.860 --> 06:18.960 regarding fabric but 155 06:18.960 --> 06:24.730 this time regarding 40 Analyzer and a 40 Analyzer fabric. So let me clean up 156 06:24.730 --> 06:25.920 some of this right here 157 06:25.920 --> 06:29.600 and let's talk about 40 Analyzer fabric. So let's imagine we have several 40 158 06:29.600 --> 06:30.640 Analyzers in our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 158 06:29.600 --> 06:30.640 Analyzers in our 159 06:30.640 --> 06:36.610 Enterprise we'll call this FAS 1 and what this is FAS 2 and over here FAS 3 and 160 06:36.610 --> 06:37.200 let's imagine these 161 06:37.200 --> 06:42.100 are all in Analyzer mode and just for grins let's also throw in FAS E4 which is 162 06:42.100 --> 06:43.840 going to be in 163 06:43.840 --> 06:47.460 collector mode. So we can have some devices that are affording their logs and 164 06:47.460 --> 06:49.360 event information to FAS 4 165 06:49.360 --> 06:52.640 as a collector who can then forward it to for example FAS 2 we're going to have 166 06:52.640 --> 06:53.360 other devices 167 06:53.360 --> 06:57.000 that are forwarding directly to FAS 3 and then FAS 2 and FAS 3 even though they 168 06:57.000 --> 06:58.000 're an analyzer 169 06:58.000 --> 07:03.070 mode can still forward their logs over to FAS 1. If we've set up the 40 Analy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 169 06:58.000 --> 07:03.070 mode can still forward their logs over to FAS 1. If we've set up the 40 Analy 170 07:03.070 --> 07:04.240 zer fabric and here's 171 07:04.240 --> 07:08.590 how it would work we would configure FAS 1 here as a supervisor as part of the 172 07:08.590 --> 07:09.600 fabric which is kind 173 07:09.600 --> 07:14.390 of equivalent to a root of the security fabric with 40 gates so in the 40 Analy 174 07:14.390 --> 07:15.280 zer fabric we'd 175 07:15.280 --> 07:19.290 have one the second as a supervisor and then these two could behave as members 176 07:19.290 --> 07:20.400 which allows them to 177 07:20.400 --> 07:25.230 forward logs information to the supervisor and then 40 Analyzer 4 which is not 178 07:25.230 --> 07:26.400 an analyzer mode 179 07:26.400 --> 07:30.090 because in collector mode it can't actually become part of the fabric it's just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 179 07:26.400 --> 07:30.090 because in collector mode it can't actually become part of the fabric it's just 180 07:30.090 --> 07:30.720 forwarding 181 07:30.720 --> 07:34.960 information to the 40 Analyzer it was told to. So the 40 Analyzer fabric let me 182 07:34.960 --> 07:35.680 go ahead and put 183 07:35.680 --> 07:40.640 this in blue would be this part right here with the members forwarding to the 184 07:40.640 --> 07:41.760 supervisor and then a 185 07:41.760 --> 07:45.510 40 Analyzer operating in collector mode would not become part of that fabric 186 07:45.510 --> 07:46.400 although it'd be 187 07:46.400 --> 07:49.670 forwarding to one of the members in that fabric. So as far as what we've 188 07:49.670 --> 07:50.720 covered so far in this 189 07:50.720 --> 07:55.550 overview we have the 40 gate security fabric which the 40 Analyzer can sort out 190 07:55.550 --> 07:56.240 and reduce 191 07:56.240 --> 08:00.230 duplicate events we also have the 40 Analyzer fabric which if we have multiple WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 191 07:56.240 --> 08:00.230 duplicate events we also have the 40 Analyzer fabric which if we have multiple 192 08:00.230 --> 08:01.200 40 Analyzers 193 08:01.200 --> 08:04.920 one would be supervisor and the other would be members in Analyzer mode so that 194 08:04.920 --> 08:05.760 's an example of 195 08:05.760 --> 08:08.900 the 40 Analyzer fabric. Another concept I'd like to share with you in this 196 08:08.900 --> 08:10.640 overview is the concept of 197 08:10.640 --> 08:15.480 administrative domains or ADOMS for short. Now in the 40 gates we have 198 08:15.480 --> 08:16.880 something called V-DOMS 199 08:16.880 --> 08:21.940 where we logically segment a firewall into multiple logical sub-firewalls if 200 08:21.940 --> 08:23.200 you will and with 40 201 08:23.200 --> 08:27.290 Analyzer we can set up 8 ADOMS administrative domains for the benefit of being 202 08:27.290 --> 08:28.000 able to give 203 08:28.000 --> 08:32.820 permissions to administrators to analyze and work with parts of the topology. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 203 08:28.000 --> 08:32.820 permissions to administrators to analyze and work with parts of the topology. 204 08:32.820 --> 08:33.520 So by setting up 205 08:33.520 --> 08:37.240 administrative domains we can have 140 Analyzer for example that's getting logs 206 08:37.240 --> 08:38.160 from all four of 207 08:38.160 --> 08:42.440 our firewalls but perhaps we have one administrative domain for these three 208 08:42.440 --> 08:43.600 firewalls at the head 209 08:43.600 --> 08:47.360 corridor location and we have a separate administrative domain regarding the 210 08:47.360 --> 08:48.640 branch firewall and that 211 08:48.640 --> 08:51.930 way different administrators could have different access and permissions as 212 08:51.930 --> 08:52.720 they interact with the 213 08:52.720 --> 08:56.900 40 Analyzer depending on which administrative domain they've been given access 214 08:56.900 --> 08:57.760 and privileges 215 08:57.760 --> 09:01.980 to. And one other aspect that's really important when bringing up a new 40 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 215 08:57.760 --> 09:01.980 to. And one other aspect that's really important when bringing up a new 40 216 09:01.980 --> 09:03.440 Analyzer is understanding 217 09:03.440 --> 09:07.380 our options for connecting to it and the two major options are connecting via 218 09:07.380 --> 09:08.240 the command line 219 09:08.240 --> 09:12.610 interface or we could use the GUI and we think of the GUI like a browser using 220 09:12.610 --> 09:13.360 a browser to 221 09:13.360 --> 09:17.580 connect to the 40 Analyzer to do our work and at the 40 Analyzer we can specify 222 09:17.580 --> 09:18.560 via permissions 223 09:18.560 --> 09:22.270 exactly what is allowed regarding connecting to it. So for the CLI we can able 224 09:22.270 --> 09:23.600 things like SSH 225 09:23.600 --> 09:28.150 and for the GUI we can have HTTPS we also could allow HTTP although that's 226 09:28.150 --> 09:29.040 insecure because it's 227 09:29.040 --> 09:33.570 not encrypted and then for the CLI once we're at the GUI we also have an option WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 227 09:29.040 --> 09:33.570 not encrypted and then for the CLI once we're at the GUI we also have an option 228 09:33.570 --> 09:34.160 from the GUI from 229 09:34.160 --> 09:36.880 the browser interface when we're working with the 40 Analyzer to go ahead and 230 09:36.880 --> 09:37.840 click a button to get 231 09:37.840 --> 09:41.830 a CLI to the 40 Analyzer should we need to issue command line interface 232 09:41.830 --> 09:43.280 commands. So as we go through 233 09:43.280 --> 09:47.050 this content together I'll give you examples of working with these options 234 09:47.050 --> 09:48.080 including options 235 09:48.080 --> 09:53.440 regarding how to connect to the 40 Analyzer.