WEBVTT

1
00:00.000 --> 00:02.480
In this video I like to walk you through what it looks like when we have these

2
00:02.480 --> 00:03.200
three firewalls

3
00:03.200 --> 00:06.720
as part of the same security fabric and that way the login information will be

4
00:06.720 --> 00:07.440
listed duplicates

5
00:07.440 --> 00:11.120
here at the 4D Analyzer because all three of these devices are part of the same

6
00:11.120 --> 00:12.000
security fabric.

7
00:12.000 --> 00:15.840
So to do that let's go ahead and make firewall 1 the root of the security

8
00:15.840 --> 00:16.400
fabric

9
00:16.400 --> 00:20.000
and then we'll have firewall 2 and firewall 3 joins. So port 4 will be the

10
00:20.000 --> 00:20.800
upstream port

11
00:20.800 --> 00:25.600
that firewall 2 and firewall 3 will use to join this security fabric and if we

12
00:25.600 --> 00:26.320
come across any

13
00:26.320 --> 00:29.970
bumps in the road we'll handle them as they come up. Alright so currently we

14
00:29.970 --> 00:31.200
have firewall 1, 2,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.970 --> 00:31.200
have firewall 1, 2,

15
00:31.200 --> 00:35.430
and 3 as three separate individuals who are reporting to 4D Analyzer and let's

16
00:35.430 --> 00:36.720
go to firewall 1

17
00:36.720 --> 00:40.710
and we'll go down to security fabric and fabric connectors and currently it's

18
00:40.710 --> 00:41.760
stand alone here

19
00:41.760 --> 00:46.020
in the security fabric setup so we'll click that click on edit on firewall 1

20
00:46.020 --> 00:47.440
and we'll serve as the

21
00:47.440 --> 00:52.020
fabric root. We'll use port 4 as the port that the downstream firewalls can

22
00:52.020 --> 00:53.200
join the fabric and

23
00:53.200 --> 00:58.560
we'll call this our FGT fabric and for the management IP address I'm going to

24
00:58.560 --> 00:59.280
specify the

25
00:59.280 --> 01:02.570
management IP address I'm currently using to manage that firewall which is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:59.280 --> 01:02.570
management IP address I'm currently using to manage that firewall which is

26
01:02.570 --> 01:03.440
firewall 1 and we'll

27
01:03.440 --> 01:08.360
click on okay I also want to make sure under network and interfaces I want to

28
01:08.360 --> 01:09.760
make sure port 4 is

29
01:09.760 --> 01:14.030
willing to go ahead and allow security fabric connections. So here under

30
01:14.030 --> 01:15.440
network interface for

31
01:15.440 --> 01:18.850
port 4 currently we're allowing security fabric connections to come in

32
01:18.850 --> 01:20.080
fantastic. So let me go

33
01:20.080 --> 01:23.980
back to security fabric fabric connectors and currently we are the root and we

34
01:23.980 --> 01:24.720
're currently

35
01:24.720 --> 01:28.900
logging to 4D Analyzer so let's go over to firewall 2 and tell it to join the

36
01:28.900 --> 01:29.360
fabric.

37
01:29.360 --> 01:32.920
So here in firewall 2 we'll go down to security fabric and then fabric
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.360 --> 01:32.920
So here in firewall 2 we'll go down to security fabric and then fabric

38
01:32.920 --> 01:34.160
connectors and here on

39
01:34.160 --> 01:37.980
the tile for security fabric setup we'll go ahead and click on it click on edit

40
01:37.980 --> 01:38.560
and we'll say you're

41
01:38.560 --> 01:41.690
not going to be stand alone you're going to go ahead and join an existing

42
01:41.690 --> 01:42.640
fabric and I don't need

43
01:42.640 --> 01:46.210
to worry about an anthropology about other downstream devices beyond it and the

44
01:46.210 --> 01:46.640
upstream

45
01:46.640 --> 01:52.910
4D gate IP address is 10.123.0.51. So let's confirm that together. So this port

46
01:52.910 --> 01:53.760
4 here

47
01:53.760 --> 01:59.360
is the IP address of 10.123.0.51 that's the IP address the last octet last

48
01:59.360 --> 02:00.560
number I used for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:59.360 --> 02:00.560
number I used for

49
02:00.560 --> 02:04.960
all of its interfaces. So that would be the correct IP address for firewall 2

50
02:04.960 --> 02:06.160
to use to join

51
02:06.160 --> 02:11.120
the root and become part of the 4D gate security fabric. So for a single sign-

52
02:11.120 --> 02:11.600
on I'm going to set

53
02:11.600 --> 02:15.380
that to manual click on okay and it says joining an upstream device will cause

54
02:15.380 --> 02:16.880
this device's automation

55
02:16.880 --> 02:20.540
configuration to be discarded and because I haven't set up any animation yet

56
02:20.540 --> 02:21.200
that's okay and we'll

57
02:21.200 --> 02:24.810
click on okay all right and then we'll go to firewall 3 and we'll do a similar

58
02:24.810 --> 02:25.920
thing we'll go to security

59
02:25.920 --> 02:29.500
fabric fabric connectors and then here for security fabric setup we'll click

60
02:29.500 --> 02:31.120
that click on edit and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

60
02:29.500 --> 02:31.120
that click on edit and

61
02:31.120 --> 02:33.860
then we'll specify that we wanted to join the fabric as well. So we're going to

62
02:33.860 --> 02:34.560
join an existing

63
02:34.560 --> 02:39.460
fabric and that's the upstream slash firewall 1's IP address of 10.123.0.51.

64
02:39.460 --> 02:40.240
For SAML settings

65
02:40.240 --> 02:44.590
let's go ahead and do manual and then click on okay. Again this warning is that

66
02:44.590 --> 02:45.280
any device

67
02:45.280 --> 02:47.860
automation configuration will be discarded that's fine because we haven't

68
02:47.860 --> 02:49.040
configured any yet and

69
02:49.040 --> 02:52.940
I'll click on okay. So now these three firewalls firewall 1 firewall 2 and

70
02:52.940 --> 02:54.160
firewall 3 are part of

71
02:54.160 --> 02:57.730
the same security fabric. Another interesting note is that if we hadn't yet had

72
02:57.730 --> 02:58.480
firewall 2 and

73
02:58.480 --> 03:03.060
firewall 3 sending logging over to 40 analyzer by joining the security fabric
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:58.480 --> 03:03.060
firewall 3 sending logging over to 40 analyzer by joining the security fabric

74
03:03.060 --> 03:04.400
where firewall 1 was

75
03:04.400 --> 03:07.990
already sending over to the 40 analyzer firewall 2 and firewall 3 would also

76
03:07.990 --> 03:09.360
have incorporated the

77
03:09.360 --> 03:12.810
sending of messages over to 40 analyzer and once again we'd have to go to 40

78
03:12.810 --> 03:13.440
analyzer to

79
03:13.440 --> 03:18.140
specify that we want to allow those inbound connections as authorized devices

80
03:18.140 --> 03:18.640
and as we go

81
03:18.640 --> 03:25.230
back to firewall 2 and firewall 3 oh we have to add firewall 1 specify that we

82
03:25.230 --> 03:26.480
need to authorize

83
03:26.480 --> 03:30.800
firewall 2 and firewall 3 to join the security fabric. So back at firewall 1 we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:26.480 --> 03:30.800
firewall 2 and firewall 3 to join the security fabric. So back at firewall 1 we

84
03:30.800 --> 03:31.760
need to authorize

85
03:31.760 --> 03:35.750
firewall 2 and firewall 3 to join so let's go ahead and click on the link there

86
03:35.750 --> 03:36.720
and then click on firmware

87
03:36.720 --> 03:40.440
and registration which takes us to system firmware and registration and then we

88
03:40.440 --> 03:40.960
can go ahead and

89
03:40.960 --> 03:45.440
take firewall 2 and firewall 3 and with them both selected we can click on

90
03:45.440 --> 03:46.640
authorize. So now those

91
03:46.640 --> 03:50.120
two firewalls are authorized to join this fabric. So now if we go back to

92
03:50.120 --> 03:51.200
firewall 2 it's showing

93
03:51.200 --> 03:55.800
as authorized and same thing for firewall 3 it's also showing as authorized and

94
03:55.800 --> 03:57.040
the benefit of having

95
03:57.040 --> 04:01.190
these 40 gates as part of the same security fabric is that now as they're all
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:57.040 --> 04:01.190
these 40 gates as part of the same security fabric is that now as they're all

96
04:01.190 --> 04:02.720
sending logs over to

97
04:02.720 --> 04:08.230
the 40 analyzer the 40 analyzer can logically treat them all as one device or

98
04:08.230 --> 04:09.680
one entity and can help

99
04:09.680 --> 04:14.840
reduce duplicates. So for doing for example IDS here, IPS here or an anti-mal

100
04:14.840 --> 04:16.080
ware here and maybe

101
04:16.080 --> 04:20.180
other security measures here all that log information is going to be sent over

102
04:20.180 --> 04:21.280
and correlated here at

103
04:21.280 --> 04:25.070
the 40 analyzer. So we won't miss anything but at the same time we won't have

104
04:25.070 --> 04:26.400
duplicate information

105
04:26.400 --> 04:29.750
for the same exact event coming from two different firewalls. Because the 40

106
04:29.750 --> 04:30.480
analyzers treat the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
04:29.750 --> 04:30.480
analyzers treat the

107
04:30.480 --> 04:35.210
security fabric as one larger logical device. So back at 40 analyzer now if we

108
04:35.210 --> 04:36.800
go to device manager

109
04:36.800 --> 04:42.370
it's now showing us that as part of this FGT fabric it includes firewall 1

110
04:42.370 --> 04:44.640
firewall 2 and firewall 3

111
04:44.640 --> 04:48.480
as part of that same security fabric and this one up here is the branch

112
04:48.480 --> 04:49.680
firewall off on the right

113
04:49.680 --> 04:54.880
hand side of our topology.