The ISR Family Expands SD-WAN Security and LTE Support

By now you most likely already know the benefits of implementing a software-defined WAN (SD-WAN). It’s no wonder 95% of enterprises surveyed by IDC expect to use SD-WAN within 24 months.

Cost of WAN Operations over 5 years. IDC: Business Value of Software-Defined Networking Infographic

Did you know, however, that SD-WAN could help lower your WAN costs by 38% over 5 years? Recent IDC customer interviews of mid to large enterprises found that respondents reported 38% lower 5-year cost of operations, 45% reduced app latency, and 33% more efficient WAN management when deploying Cisco SD-WAN solutions2.

So, if you’re considering an upgrade to SD-WAN, you’ll be happy to know that Cisco is continuing to expand platform support for Cisco SD-WAN powered by Viptela with new ISR models. We’re excited to introduce the new ISR 1120 and ISR 1160 models to the ISR 1000 Series. Both models will support the full suite of Cisco SD-WAN features including a full stack of security capabilities.

Why do you need the latest ISR 1000 models?

◈ Better user experience – The ISR 1160 is the highest performing router of the ISR 1000 series yet, featuring increased throughput and a 25% faster processor. Faster performance plus application optimization with Cisco SD-WAN equals happier employees and guests.

◈ Any location, any transport – Last year we introduced pluggable LTE technology with the ISR 1101 and 1109 models, and now we’re happy to introduce the same technology with the new ISR 1120 and 1160 models. This allows you to plug-in a CAT4 or CAT6 module for advanced LTE connectivity and with the fast paced growth of LTE technology, you’ll be able to upgrade to future LTE band support, like 5G, with ease.

◈ Right security, right place – Now you can protect users and devices and deploy embedded or cloud security faster using SD-WAN Security. The new ISR models feature 8GB of memory so you can run the full-stack of security, including application firewall, IPS, URL-Filtering and AMP directly into your ISR and manage it remotely via Cisco vManage.

Don’t forget that Cisco provides support, fulfillment and hardware replacement across the globe. With all the best features of the ISR 1000 Series and cost savings of Cisco SD-WAN, now available with the new ISR 1120 and 1160 models, it’ll be hard to find a reason not to deploy a software-defined network.

Continue reading

With Cisco Threat Response, The Best Things in Threat Hunting are Free

For those of us in security operations, it could be easy to feel discouraged. After all, it’s an unfair fight. The bad actors seem to have unlimited time and budget. And we certainly don’t!

But here’s some good news: one of the most valuable tools available in threat hunting is free. Just like the golden oldie tune (or the Janet/Luther pop classic) says, the best things in life don’t always cost money. For customers with Cisco Next-Generation Firewalls, Intrusion Prevention (IPS), AMP for Endpoints, Cisco Umbrella, Email Security, and/or Threat Grid, Cisco Threat Response helps detect, investigate, and take corrective action against cyber threats—at no additional cost.

Making the Fight More Fair

We work with security professionals in organizations of all types and sizes. No matter their differences, they all say they’re bombarded. They wish they could “hit pause” on the flood of security events to allow for the time-consuming manual work they have to do after an attack. Not only that, they’re often in the difficult position of having to make decisions with inadequate information. They’re concerned about blocking too much and compromising productivity. Or not blocking enough to protect the business.

Cisco Threat Response provides an automated process to help. It’s a key pillar of Cisco’s integrated security architecture and designed to give you the contextual awareness you need so you can see, investigate, and act on threats fast. If you’ve invested in Cisco security products that support it, Threat Response is on your side to make the fight against cyberattacks a little fairer.

Getting started with Cisco Threat Response is easy.

Fast for Anyone to Use

You don’t have to be an expert to use Cisco Threat Response. The interface is simple, intuitive, and interactive. Users can ask the tool to investigate a threat by simply cutting and pasting threat From the first click, Cisco Threat Response provides details on suspicious behaviors, files, and activities. Then click again, and it can be just as easy and quick to see, and in many cases remediate the root cause.

Easy-to-read, configurable graphics map the targets that have communicated with the malicious domain you’re investigating.

Not only that, information about the threat is collected and results are aggregated in the Cisco Threat Response portal. Here you get one common view, made even more powerful with knowledge from your other supported Cisco products. These products are fed by Talos, which delivers comprehensive threat intelligence with continuous updates to Cisco devices, automatically. In the Cisco Threat Response portal, it provides your network’s local sightings of the threat you’re investigating plus details to help you make timely and confident decisions about the best corrective actions.

Cisco Threat Response provides insights of integrated products to Investigate. The portal provides access to continuous threat intelligence geared to helping you respond quickly.

The browser plug-in makes it easy and convenient to pull indicators of compromise from any webpage or console and get verdicts directly from the drop-down. You can take corrective action or undertake a complete investigation (with collaboration and sharing) right from the page.

The More Cisco You Have, The More Value You Get

With the Firepower integration, Cisco Threat Response can now utilize intrusion alerts from the Firepower devices. This enrichment will amplify the contextual awareness in your network by harnessing the power of effective integrations with products such as AMP for Endpoints, Email Security, Threat Grid Umbrella and your Next-generation firewall. Another exciting thing about Cisco Threat Response is that when you have more Cisco solutions deployed, the integration drives more data enrichment and response capabilities. Contextual analysis becomes more detailed. We will continue to add new Cisco product integrations with Threat Response – the firewall products are only the most recent addition.

Continue reading

Running NetBeez Agents on Cisco Catalyst Switches

I am happy to announce a new powerful integration between NetBeez and Cisco. Starting with Cisco IOS-XE version 16.12.1, Cisco users can install the NetBeez docker agent on Cisco Catalyst 9000 series switches. This new integration is part of the Cisco application hosting framework, which enables third-party off-the-shelf applications to run on top of Cisco devices. As you’ll read in the next paragraphs, NetBeez and Cisco users will have a lot to gain from this integration. If you are new to NetBeez, let me tell you more about it.

Wide Area Network Monitoring with NetBeez

NetBeez is a distributed network monitoring solution that enables network engineering teams to monitor remote Wide Area Network locations via dedicated hardware or software agents, called Beez. The Beez run active monitoring tests, such as ping, traceroute, and iperf, as well as DNS and HTTP checks against web and cloud applications. Like a canary in a coal mine, the Beez proactively detect remote performance issues that impact end-users and business operations. The performance data logged by the Beez is sent real-time to the NetBeez central server, where it’s processed for alerting, displayed on the user dashboard, or consumed by third-party applications via the available APIs.

With the Cisco App Hosting integration, the Catalyst 9000 is capable of hosting NetBeez agents and run network performance tests from the user perspective. In this scenario, the NetBeez server is still needed to manage the Beez running on the switches and to collect the network performance data generated.

Benefits of Cisco App Hosting

Traditionally, the Beez runs on top of a Raspberry Pi that is plugged into the access switch at remote WAN sites. Companies that need to monitor large WANs have to invest considerable time and resources to ship and deploy the hardware appliances at remote locations. The Cisco App Hosting removes this “physical barrier” in the deployment and maintenance process of the Beez. Catalyst owners can now easily install via the Cisco CLI the NetBeez docker agent on their switches. Let’s see what this procedure looks like …

Configuring Catalyst for App Hosting

Configuring a Catalyst 9000 series switch to host a NetBeez docker agent is fairly simple. Before you begin, make sure you meet the following requirements:

◈ A Cisco Catalyst 9000 switch with IOS-XE version 16.12.1

◈ A USB SSD-120G for Catalyst 9000 series switches

◈ A NetBeez server running version 2.0

◈ The NetBeez docker agent v2.0.5

The procedure will have you:

1. Create a user VLAN that will be used by the NetBeez docker agent as uplink

2. Map the user VLAN to one of the switch’s access or trunk ports

3. Create an AppGigabitEthernet interface that is an internal bridge between the eth0 interface on the NetBeez agent and the user VLAN mentioned at step 1

4. Define configuration parameters needed by the NetBeez docker agent to connect to the server.

The following diagram illustrates how these different components relate to each other.

Continue reading

How AI is Changing the Game For Knowledge Workers

Have you ever wanted to ditch your mobile device, step back into the pre-internet everywhere era and pop on a Depeche Mode cassette? Yeah, me either. But for knowledge workers dealing with a constant stream of notifications and requests, stepping back a few decades might seem like a welcome reprieve. Luckily, artificial intelligence (AI) and machine learning are transforming the way we work and it’s not only leading to better outcomes, but more importantly, making our work life a little more pleasant.

“A Question of Time”

Today we can collaborate with anyone in any location but building relationships with our colleagues and focusing on higher value initiatives often takes a back seat to the day’s urgent request. In addition, the technology that’s meant to help us get our jobs done can themselves become barriers. Take a common virtual meeting, for example. Today, 85% of people experience online meeting problems and 42% felt frustrated in the last week because they could not easily join an online meeting. This software is meant to make our jobs easier and improve collaboration, but it’s not meeting our expectations. Even worse, these minor frustrations can add up to a lot of wasted time.

“The Landscape is Changing”

Enter AI and machine learning. While we’re a far way off from HAL 9000, there are market-proven AI capabilities that are being leveraged today to improve collaboration. This new form of collaboration, termed cognitive collaboration, is one where the machines are involved in the process — removing mundane tasks and facilitating a more human experience.

With capabilities like AI assistants and bots which help to facilitate and automate tasks and relationship intelligence that serves up information on meeting attendees, cognitive collaboration is transforming the virtual meeting experience.

“People are People”

According to a new survey by Dimensional Research, 72% of respondents said their meetings generally start late. When asked about why, some of the most popular responses were that they encountered:

◈ Problems joining the meeting (57%)

◈ Desktop or application sharing issues (43%)

◈ Background noise impairs the meeting (41%)

Imagine a world where everyone was prompted by a virtual assistant to join their meeting and all they had to respond was “Ok Webex, join my meeting.” No fumbling for a join code, no dial-in.

Or how about using your voice to share your screen and if you start typing away to respond to an urgent message, it’s automatically detected and your audio line is suppressed? These capabilities aren’t a future state — they are here today and are a core part of Webex Devices and Meetings.

While Webex Assistant will help your meetings run more efficiently, once you’re in the meeting, AI-generated people and company profiles will take your collaboration experience to the next level.

People Insights provides detailed profiles right in Webex Meetings, allowing us to discover shared interests and backgrounds and helping us get to know the people we meet with a little better. Not sure who someone is in the meeting? Check out their profile. Curious to see who the new person in your organization reports to? Reporting structure is a click away.

Today, over 80% of people spend up to 5 hours a week researching the people they’re meeting with — when the information you’re looking for is presented to you when you need, that’s a lot of time you can get back in your day. I’m not the only one excited about this. In a recent survey, 4 out of 5 respondents say having background information on people in the meeting would increase the meeting effectiveness. Beyond the meeting, it is helping to foster better relationships which can lead to improved team synergies and better outcomes.

“Enjoy the Silence”

These cognitive collaboration capabilities are game changers for knowledge workers, but it’s just the tip of the iceberg. As these capabilities continue to become interwoven into the collaboration platform and new AI-enabled features emerge, the in-meeting experience will rival, and maybe soon surpass, in-person collaboration. And at the end of the day, maybe that means you get a chance to enjoy the silence for a bit (cue the cassette).

Continue reading

Cisco Threat Response Plugin: Defeat Threats With Just a Few Clicks

One of the best tools in your SOC’s arsenal is something you might already have access to and didn’t even have to pay for. If you already deploy Cisco Umbrella, AMP for Endpoints, Firepower devices, next-generation intrusion prevention system (NGIPS), Email Security, or Threat Grid, then you can immediately access Cisco Threat Response for FREE. As in no charge. Zero extra dollars. No strings attached.

With Cisco Threat Response, customers receive a powerful solution that can streamline and simplify detection, investigation, and remediation of threats. In addition, Threat Response offers a very easy, powerful tool in the new browser plugin (for Chrome and Firefox). By adding the plugin, security professionals now have instant access to threat intelligence and response capabilities directly from their browser. To prove the simplicity of this, let’s use a straightforward example.

For the threat, we will use the Karkoff malware, used in the DNSpionage campaign.

Ah, it seems that Talos has a full spotlight of Karkoff. Towards the bottom of the blog, Talos gives a full report on Indicators of Compromise for Karkoff.

Traditionally, you’d have to manually copy and paste  each file, IP address, etc. from the blog, editing them to remove the defanging “safety brackets”, searching for each one in turn, in each of your telemetry sources – a laborious, manual activity. Cisco Threat Response simplifies this entire process by bringing all of these capabilities to one central source. So, let’s open the Cisco Threat Response browser plugin.

Immediately, Cisco Threat Response identifies 16 observables from this threat intelligence blog. 1 clean. 9 malicious. 6 unknown.

By clicking the malicious and unknown observables, we can tailor our investigation. We will not worry at all about snort.org, because we know Snorty is never up to anything bad!

As an example of how quickly we can take response actions, even before pivoting into Threat Response to do a more complete investigation, let’s look at kuternull.com. It is listed as “unknown.” By clicking the dropdown menu next to it, and pivoting out to other trusted intelligence sources like the Talos database or Threat Grid, we could quickly gather more information to determine a course of action.

For the purposes of simply showing the ease of the plugin, let’s assume we investigated this domain and there is no legitimate business need for our organization to be contacting it. In order to prevent potential malware activity, we will proactively block it now as a first level stopgap while we continue our investigation. Threat Response directly integrates with Umbrella, so we can immediately block the domain across our entire network with one click within the plugin.

Within a few seconds, Threat Response will flash a green banner confirming the blocking of the domain with Umbrella.

Now, after blocking a few domains quickly, our network is certainly better protected from Karkoff, but there is more investigation to be done. A quick click of the “Investigate” button will launch Cisco Threat Response’s cloud-based dashboard.

Cisco Threat Response will automatically load the list of the observables and provide insights with relation graphs, file hashes, and others.

Previously, Security Operations Centers (SOCs) would hear about trending threats and wonder, “Is my network affected by this threat?” To answer that question, it would require a series of manual processes that required investigating observables hundreds of times across the network, and then, writing sufficient policy to defend against these threats. To make life even more difficult, these solutions were often from different vendors and require manual processes to implement across different parts of the next work.

With Cisco Threat Response, within minutes, your SOC can:

1. Identify a trending threat from your SIEM, Talos, other threat intel sources, or virtually any third party product that has a web based interface

2. Identify a list of observables with one click

3. Quickly block domains across the network

4. Launch Cisco Threat Response for further investigation

It is important to note that Cisco Threat Response is a FREE add-on to existing Cisco Security solutions. In the example above, the user has Threat Response integrated with their AMP For Endpoints, Cisco Threat Grid, and Umbrella solutions. In addition, every user of Threat Response automatically gets access to the Talos Intelligence and AMP File Reputation databases for use in Threat Response. While Cisco Threat Response provides significant value when integrated with only one product, it becomes even more useful with each additional Cisco Security solution integration. It offers unparalleled central-management for detection, investigation, and remediation – and the browser plugins bring all those capabilities into any type of web content. Whether it is a blog entry like in this example, any other intelligence source, or the browser-based management console of any Cisco or third-party security or networking product.

Continue reading

Cisco CCIE Collaboration 400-051 (CCIE C): Latest [2019] Exam Guide

Exam Name: CCIE Collaboration Written Exam

Exam Code/Number: 400-051 CCIE C

Exam Overview:  This exam validates that candidates have the skills to plan, design, implement, operate, and troubleshoot enterprise collaboration and communication networks.

Practice Exam: Cisco Certified Internetwork Expert Collaboration Practice Test

Sample Questions: Cisco 400-051 Sample Questions

Continue reading

Manage Interfaces in a Centralized Way with DCNM 11

Today, we’re continuing the discussion by featuring how Cisco’s Data Center Network Manager (DCNM) empowers IT to move at the increasing speed businesses require, giving IT departments complete automation, extensive visibility, and consistent operations for their data center. DCNM is the network management platform for all NX-OS-enabled deployments, spanning new fabric architectures, IP Fabric for Media, and storage networking deployments for the Cisco Nexus-powered data center.

Why DCNM 11?

With its advanced features, Cisco’s DCNM 11 supports the management of interfaces individually at a per device level, a fabric level, or a data center level. This is done either via the GUI or equivalent REST APIs. While many tools provide just about every possible permutation for interface configuration, DCNM 11 comes with best practice interface policy templates that will serve the most common deployment scenarios. For more sophisticated use-cases, the interface policy templates within DCNM can be easily customized to meet the user’s specific needs. In addition, the following interface-related operations are also available:

◈ Create/Edit/Delete of logical interfaces like vPCs, Port-Channels, Loopbacks, Sub-interfaces

◈ Attach Networks and VRFs to interfaces using one click

◈ Configuration Straight-Through (ST) and Active-Active (AA) FEX

◈ Interface operations like admin down/up and show commands using templates

◈ Configuration of Routed, Access, Trunk Interfaces

◈ View history for each interface – who did what, when at an interface level

◈ Check compliance status for every interface

◈ Configuration of breakout interfaces

◈ Interface statistics on per interface or per link basis

◈ Per Interface neighbor discovery using LLDP/CDP

How it works

Interface of Switches discovered by DCNM can be seen by navigating to Control -> Fabrics -> Interfaces. The scope selector allows you to filter the list of interfaces at a Data Center level or at a per fabric level. Various filtering options are available, including the ability to modify interface configuration in bulk. The global interface view provides a combination of information that is configured via the DCNM as well as operational information based run time state.

Interface management at a fabric level

Interface Controls

Per switch level interface management can be done via Fabric Builder with a simple right click sub-menu selection.

Interface management at a switch level

Typically, there are two types of interfaces: network interfaces that represent a inter-switch link or ISL, and host facing interfaces that are typically attached to end points (servers, appliances etc.). An ISL or a link may be further classified as a intra-fabric or inter-fabric link. Intra-fabric links are between devices that are part of the same fabric, while inter-fabric links are typically used for external connectivity out of a fabric. DCNM allows users to pre-provision inter and intra fabric physical and logical links using link policy templates. A link policy template in turn references child interface policy templates, one each for either end of the link.

DCNM then gathers and populates interface level statistics in the health dashboard. Interface and per link statistics – including transmit/receive byte/packet counters, error counters, and more – are available for archival and perusal. Daily or weekly reports may also be generated for interface statistics.

Real-time interface statistics in Topology Page

Topology -> Double clicking a link shows 24 H traffic patters

Control -> Fabric -> Interfaces -> Traffic pattern at an interface level

Interface or link up/down events result in trap notifications that in turn can be used to trigger alarms based on user configured policies. In general, for brownfield deployments, DCNM always preserves the switch and corresponding interface level configuration. DCNM learns the configuration of not only the physical but also the logical interfaces that are present on the switch. Resources such as port-channel IDs, loopback IDs, ip addresses, etc. are also marked as used in the DCNM resource manager. Subsequently, existing interfaces can be edited or new interfaces can be incrementally provisioned via the DCNM for continuous operation.

DCNM features configuration compliance that keeps track of the expected-config/intent defined by the user and the running configuration on the switches at all times. Any drift from the interface intent, including changes made out-of-band, marks the interface, and hence the switch, as ‘OUT-OF-SYNC’. Remediation is suggested by generating a set of pending configuration that will mutate the current running configuration to the current expected configuration (intent) on execution. This brings the interface, and hence the switch, back ‘IN-SYNC’. DCNM’s own resource manager keeps track of all interface configurations, and mutations are backed up at all times for a future rollback.

Interface management from DCNM

Continue reading