WEBVTT

1
00:00.000 --> 00:04.070
So now that we have the 40 Analyzer verified, it's reachable by our management

2
00:04.070 --> 00:04.800
computer.

3
00:04.800 --> 00:08.930
Let me walk you through how we can add individual devices like 40 gate firew

4
00:08.930 --> 00:09.840
alls to send their

5
00:09.840 --> 00:13.300
logging information and event information over to the 40 Analyzer. So at the

6
00:13.300 --> 00:13.680
moment,

7
00:13.680 --> 00:18.080
I currently have firewall one and also the branch firewall here, both setting

8
00:18.080 --> 00:18.560
their log

9
00:18.560 --> 00:22.480
information over to the 40 Analyzer. But what isn't happening is I don't have

10
00:22.480 --> 00:23.440
firewall two or

11
00:23.440 --> 00:28.000
firewall three yet setting their log information over. So it's really simple to

12
00:28.000 --> 00:28.640
both tell these

13
00:28.640 --> 00:32.550
firewalls to send the logs. It's also very simple to sell the 40 Analyzer to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.640 --> 00:32.550
firewalls to send the logs. It's also very simple to sell the 40 Analyzer to

14
00:32.550 --> 00:33.680
welcome those incoming

15
00:33.680 --> 00:38.250
logs. So let's demonstrate that right now. So this is the 40 Analyzer and

16
00:38.250 --> 00:39.680
currently to see who is

17
00:39.680 --> 00:44.000
sending logs to this device, we go to device manager. And with device manager

18
00:44.000 --> 00:44.560
selected,

19
00:44.560 --> 00:50.480
it's showing us that we have hg firewall one, and also this device over at dot

20
00:50.480 --> 00:51.520
71 on my management

21
00:51.520 --> 00:54.720
network, which is the branch firewall that's saying it over as well. And

22
00:54.720 --> 00:55.760
because this firewall

23
00:55.760 --> 00:59.600
right here is part of a h a cluster. That's why it's showing up with this name

24
00:59.600 --> 01:00.720
right here cluster
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:59.600 --> 01:00.720
right here cluster

25
01:00.720 --> 01:04.700
one fgd 60 f also I thought it'd be interesting to go ahead and have firewall

26
01:04.700 --> 01:06.160
one here with a feature

27
01:06.160 --> 01:12.240
release seven six and the firewall over at the branch office is currently 748,

28
01:12.240 --> 01:13.120
which is the as of

29
01:13.120 --> 01:17.360
this recording, one of the more mature versions available for the 40 us. So

30
01:17.360 --> 01:18.560
again, what's not here

31
01:18.560 --> 01:21.760
is firewall two and firewall three. And just to confirm where they are on the

32
01:21.760 --> 01:22.480
topology firewall

33
01:22.480 --> 01:26.860
two is right here. And firewall three is right here. And my 192 168 one

34
01:26.860 --> 01:28.080
management network is

35
01:28.080 --> 01:32.280
consistent across the rest. So firewall two ends in dot 52 for its management
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

35
01:28.080 --> 01:32.280
consistent across the rest. So firewall two ends in dot 52 for its management

36
01:32.280 --> 01:32.880
interface,

37
01:32.880 --> 01:36.480
firewall three ends in dot 53. So with that in mind, let's go over to firewall

38
01:36.480 --> 01:37.600
two and firewall three

39
01:37.600 --> 01:41.870
and tell them to start sending their logs over to the 40 analyzer. So here is

40
01:41.870 --> 01:43.040
firewall two just at

41
01:43.040 --> 01:47.250
the top left there shows us the actual name at hq firewall two. And now to tell

42
01:47.250 --> 01:48.160
this firewall

43
01:48.160 --> 01:52.140
firewall to to start sending log and event messages over to the 40 analyzer, we

44
01:52.140 --> 01:52.400
're going to go

45
01:52.400 --> 01:55.780
down to security fabric, and then we're going to click on external connectors.

46
01:55.780 --> 01:56.560
So here on firewall

47
01:56.560 --> 02:00.940
two, we're going to go down to security fabric and click on fabric connectors.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
01:56.560 --> 02:00.940
two, we're going to go down to security fabric and click on fabric connectors.

48
02:00.940 --> 02:01.760
And here for logging

49
02:01.760 --> 02:05.380
and analytics, currently, we're not logging to a 40 analyzer. So we'll click

50
02:05.380 --> 02:06.480
here, then click on

51
02:06.480 --> 02:11.020
edit, and then specify for 40 analyzer, we want to enable logging, and then we

52
02:11.020 --> 02:11.760
'll specify where

53
02:11.760 --> 02:14.910
we're going to log to, and we'll put in the IP address that's reachable on our

54
02:14.910 --> 02:15.600
measurement network,

55
02:15.600 --> 02:21.150
which is 192 dot 168 dot 1 dot 81. And then let's go ahead and say real time

56
02:21.150 --> 02:22.240
uploads. And that way,

57
02:22.240 --> 02:25.350
when something happens at this 40 gate regarding logs and events, it can

58
02:25.350 --> 02:26.320
immediately send them

59
02:26.320 --> 02:30.980
over. And then we'll click on, okay, 40 analyzer needs to approve and authorize
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

59
02:26.320 --> 02:30.980
over. And then we'll click on, okay, 40 analyzer needs to approve and authorize

60
02:30.980 --> 02:32.000
the inbound

61
02:32.000 --> 02:35.550
messages from firewall two. So that's an additional step that needs to happen

62
02:35.550 --> 02:36.480
as well. So we'll take

63
02:36.480 --> 02:39.860
care of that as well. So I'll click on accept here. And let's go on to firewall

64
02:39.860 --> 02:40.640
three and tell

65
02:40.640 --> 02:45.060
it also to start sending log information over to the 40 analyzer. So here we

66
02:45.060 --> 02:46.320
are at firewall three. I

67
02:46.320 --> 02:50.300
did slightly change the color coding here. So that's easy to recognize it's a

68
02:50.300 --> 02:51.600
different firewall.

69
02:51.600 --> 02:55.680
So we're on firewall three. Once again, we go down to security fabric, and then

70
02:55.680 --> 02:56.320
we go to fabric

71
02:56.320 --> 02:59.660
connectors. And then here in the section called logging and analytics, we'll go

72
02:59.660 --> 03:00.400
ahead and click on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

72
02:59.660 --> 03:00.400
ahead and click on

73
03:00.400 --> 03:04.790
that, and then click on edit, and then specify one to enable 40 analyzer

74
03:04.790 --> 03:06.160
logging, and then specify

75
03:06.160 --> 03:12.020
the IP address of our 40 analyzer, which is 192.168.1.81. And let's also do

76
03:12.020 --> 03:13.440
real time there as well,

77
03:13.440 --> 03:16.790
and click on okay. And then once again, before this allowed to actually send

78
03:16.790 --> 03:17.840
the logs, we need to

79
03:17.840 --> 03:22.130
authorize that over at the 40 analyzer. So click on accept there, and then we

80
03:22.130 --> 03:23.280
'll go to the 40 analyzer

81
03:23.280 --> 03:26.650
and say, Hey, you know, these two firewalls firewall two and firewall three,

82
03:26.650 --> 03:27.600
they both would like to

83
03:27.600 --> 03:31.750
log to is that okay? And once the 40 analyzer says yes, then firewall two and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:27.600 --> 03:31.750
log to is that okay? And once the 40 analyzer says yes, then firewall two and

84
03:31.750 --> 03:32.800
firewall three can

85
03:32.800 --> 03:37.120
start forwarding their logs. So back to the 40 analyzer, we go and here under

86
03:37.120 --> 03:38.160
device manager,

87
03:38.160 --> 03:42.380
you'll notice we have two firewalls that are authorized logging devices. And

88
03:42.380 --> 03:43.200
then we have couple

89
03:43.200 --> 03:46.360
here that are unauthorized. So if we click on that, it's going to show us those

90
03:46.360 --> 03:47.120
two firewalls.

91
03:47.120 --> 03:50.440
That's firewall two and firewall three. So we just click on both of them to

92
03:50.440 --> 03:51.120
select them,

93
03:51.120 --> 03:54.890
and then click on authorize. And it's asking us to confirm also right here, if

94
03:54.890 --> 03:55.760
we had set up

95
03:55.760 --> 03:59.210
multiple administrative domains, we could actually associate these firewalls

96
03:59.210 --> 04:00.160
with a specific
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:59.210 --> 04:00.160
with a specific

97
04:00.160 --> 04:03.220
administrative domain. So I'm going to put these in the root domain effectively

98
04:03.220 --> 04:04.000
, we're not using

99
04:04.000 --> 04:07.380
multiple adams yet, and we'll click on okay, so it's doing the device

100
04:07.380 --> 04:08.640
authorization, and that may

101
04:08.640 --> 04:12.050
take a moment or two. So we'll click on close, it's now starting to up and two

102
04:12.050 --> 04:13.120
down. But here in a

103
04:13.120 --> 04:16.670
moment firewall two and firewall three should show up as well. So we'll give

104
04:16.670 --> 04:17.680
that a moment to go

105
04:17.680 --> 04:20.930
ahead and settle. Meanwhile, let's go take a look at firewall two and firewall

106
04:20.930 --> 04:22.400
three. So here's

107
04:22.400 --> 04:26.060
firewall two, it still says unauthorized. So let's go ahead and refresh this

108
04:26.060 --> 04:27.040
page by just bouncing

109
04:27.040 --> 04:30.930
off and coming back to it. And the 40 analyzer hasn't finished its work yet. So
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:27.040 --> 04:30.930
off and coming back to it. And the 40 analyzer hasn't finished its work yet. So

110
04:30.930 --> 04:31.760
let's also verify

111
04:31.760 --> 04:34.910
on firewall three. And there we go firewall three doesn't show a problem, which

112
04:34.910 --> 04:35.840
is 40 analyzer

113
04:35.840 --> 04:39.820
connected fantastic. Let's go back to firewall two. So back at firewall two,

114
04:39.820 --> 04:40.640
sure enough, we are

115
04:40.640 --> 04:43.960
now showing connected there. And if we go back to the 40 analyzer and do a

116
04:43.960 --> 04:45.840
refresh there, it shows

117
04:45.840 --> 04:49.750
three up one down. But I imagine here for way just a moment or two, it should

118
04:49.750 --> 04:50.800
show us that we have

119
04:50.800 --> 04:54.580
four out of four up. So let me go ahead and click on device manager again. And

120
04:54.580 --> 04:55.600
sure enough, we have

121
04:55.600 --> 05:01.760
four out of four up and reporting. So all the logs now from these four 48 firew
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:55.600 --> 05:01.760
four out of four up and reporting. So all the logs now from these four 48 firew

122
05:01.760 --> 05:02.720
alls are being sent

123
05:02.720 --> 05:07.240
over to 40 analyzer. So as the test here's what I propose we do, let's go to PC

124
05:07.240 --> 05:08.400
two. And let's go

125
05:08.400 --> 05:12.450
ahead and forward some traffic out to the internet. And that information

126
05:12.450 --> 05:13.840
regarding PC two should be

127
05:13.840 --> 05:18.150
sent over to 40 analyzer. Also be aware that at the moment firewall two

128
05:18.150 --> 05:19.680
firewall three and firewall

129
05:19.680 --> 05:23.490
one are not part of the same security fabric. So until we have that set up, we

130
05:23.490 --> 05:24.160
may have some

131
05:24.160 --> 05:28.890
duplicate logs as well. So let's go to PC two and send some traffic out to the

132
05:28.890 --> 05:30.000
internet. So here is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
05:28.890 --> 05:30.000
internet. So here is

133
05:30.000 --> 05:35.350
PC two, let me go ahead and open up a browser. And on one of the two firewalls,

134
05:35.350 --> 05:36.080
and it's going to be

135
05:36.080 --> 05:40.210
either firewall two or firewall one, they're requiring authentication. So open

136
05:40.210 --> 05:41.680
the network login page,

137
05:41.680 --> 05:46.170
then we'll log on is ad dash user dash two, I'll put in the password for that

138
05:46.170 --> 05:46.960
user, and then we'll

139
05:46.960 --> 05:51.580
click on continue. Fantastic. And let's go to for net.com. So I'll close that

140
05:51.580 --> 05:52.720
browser. So that

141
05:52.720 --> 05:57.210
traffic should be logged here on firewall two and also here at firewall one, as

142
05:57.210 --> 05:58.160
that client's traffic

143
05:58.160 --> 06:01.360
is going out to the internet. And because firewall two and firewall one are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
05:58.160 --> 06:01.360
is going out to the internet. And because firewall two and firewall one are

144
06:01.360 --> 06:03.280
both reporting to 40 analyzer,

145
06:03.280 --> 06:07.900
we should be able to see both of those logs right here at the 40 analyzer

146
06:07.900 --> 06:09.440
regarding PC two's traffic.

147
06:09.440 --> 06:12.800
In fact, let's generate some traffic that'll be really easy to identify. So let

148
06:12.800 --> 06:13.760
's go to YouTube,

149
06:13.760 --> 06:16.860
and that way it'll be easier to pick it out of the crowd. All right, so we're

150
06:16.860 --> 06:17.600
going to YouTube,

151
06:17.600 --> 06:21.370
fantastic. I'll close that. I'll minimize that browser. And let's go back to

152
06:21.370 --> 06:22.320
the 40 analyzer

153
06:22.320 --> 06:26.240
and take a look at the logs. So back at 40 analyzer, we're going to talk a lot

154
06:26.240 --> 06:26.720
about the

155
06:26.720 --> 06:31.090
different options here to look at the details and logs. But if we go to log
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
06:26.720 --> 06:31.090
different options here to look at the details and logs. But if we go to log

156
06:31.090 --> 06:32.480
view, and then we go to

157
06:32.480 --> 06:36.820
40 gate, we can look at the individual 40 gate firewalls at their logs. And

158
06:36.820 --> 06:37.680
what's really happening

159
06:37.680 --> 06:40.630
is we're not reaching out and looking at the logs at those 40 gates, those 40

160
06:40.630 --> 06:41.200
gates have already

161
06:41.200 --> 06:46.170
sent that log information over to the 40 analyzer. So currently I have traffic

162
06:46.170 --> 06:46.800
selected,

163
06:46.800 --> 06:50.240
looking at the traffic logs. So here in the traffic logs, if we want to sort

164
06:50.240 --> 06:50.800
out based on

165
06:50.800 --> 06:54.280
40 firewall, I can say instead of looking at all devices, let's take a look at

166
06:54.280 --> 06:55.280
firewall two,

167
06:55.280 --> 06:58.960
and we'll click on okay. And this is just going to show us the logs that were

168
06:58.960 --> 06:59.680
sent over from

169
06:59.680 --> 07:03.130
firewall two, which is our Linux client right here. So if we click on that, it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
06:59.680 --> 07:03.130
firewall two, which is our Linux client right here. So if we click on that, it

170
07:03.130 --> 07:03.760
's 10, 20,

171
07:03.760 --> 07:07.550
0, 1, 0, 2, let me just confirm that's the IP address on our Linux device,

172
07:07.550 --> 07:08.640
which is PC two. So

173
07:08.640 --> 07:13.060
we'll bring up a command prompt here, and do an IF config. And sure enough, 10

174
07:13.060 --> 07:14.080
dot 20 dot 0 dot 1,

175
07:14.080 --> 07:17.850
0, 2. Then if we go back up here and say, you know, instead of just firewall

176
07:17.850 --> 07:18.880
two, let's go ahead and

177
07:18.880 --> 07:23.000
change that just to firewall one and click on okay. Once again, we should be

178
07:23.000 --> 07:23.440
able to

179
07:23.440 --> 07:27.690
see information from firewall one's perspective about the traffic. So if we

180
07:27.690 --> 07:29.040
scroll down and go to

181
07:29.040 --> 07:33.310
page two, there we go. There's 80 user two. So the failed connection is very
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
07:29.040 --> 07:33.310
page two, there we go. There's 80 user two. So the failed connection is very

182
07:33.310 --> 07:34.160
likely before we

183
07:34.160 --> 07:37.720
authenticated. So I could right click here and then add a filter. And then this

184
07:37.720 --> 07:38.480
is firewall one

185
07:38.480 --> 07:43.140
reporting on all the logs where the traffic was sourced from 80 user two at

186
07:43.140 --> 07:44.080
that IP address 10

187
07:44.080 --> 07:47.830
dot 20 dot 0 dot 1, 0, 2. And the quick traffic would be related to the way

188
07:47.830 --> 07:49.600
that YouTube is forwarding

189
07:49.600 --> 07:53.350
the streams of data down to the client. Now it's also interesting to note that

190
07:53.350 --> 07:54.320
firewall one has

191
07:54.320 --> 07:57.650
associated this IP address with 80 user two. But if we go back, if we clear the

192
07:57.650 --> 07:58.640
filters by clicking on

193
07:58.640 --> 08:03.420
the X here, if we go back to firewall two only and click on okay, there's our
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

193
07:58.640 --> 08:03.420
the X here, if we go back to firewall two only and click on okay, there's our

194
08:03.420 --> 08:04.480
Linux client. But from

195
08:04.480 --> 08:07.420
the perspective of firewall two, here we have the Linux client again, but it

196
08:07.420 --> 08:08.320
doesn't say that it's

197
08:08.320 --> 08:12.560
80 dash user two. And that very likely is because of this firewall one has some

198
08:12.560 --> 08:13.600
policies in place

199
08:13.600 --> 08:17.760
requiring authentication identifying who the user is while firewall two doesn't

200
08:17.760 --> 08:18.640
. And as a result,

201
08:18.640 --> 08:22.770
that's why the reports coming from firewall one included the ID and the reports

202
08:22.770 --> 08:23.760
coming from firewall

203
08:23.760 --> 08:29.910
two didn't. And this will all be more cohesive if if we had a 40 gate security

204
08:29.910 --> 08:31.200
fabric where, for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

204
08:29.910 --> 08:31.200
fabric where, for

205
08:31.200 --> 08:35.380
example, firewall one was the route. And then firewall two and firewall three

206
08:35.380 --> 08:36.720
were members of the security

207
08:36.720 --> 08:40.650
fabric. In fact, in the next video, let's do exactly that and tell these three

208
08:40.650 --> 08:41.360
firewalls that

209
08:41.360 --> 08:44.710
they are part of the same security fabric. And then we can compare and contrast

210
08:44.710 --> 08:45.520
that with the 40

211
08:45.520 --> 08:48.820
analyzer logs that are coming in. So I'll see you in the next video for exactly

212
08:48.820 --> 08:49.120
that.