How Cybersecurity Leads to Improved Sustainability

After managing the sudden switch to remote work in 2020, organizations are making a more permanent transition into the flexible hybrid workforce. The Federal Bureau of Investigation (FBI) found that cybersecurity attacks rose by 3-4 times from the transition to remote work in 2020. In addition, experts predict that ransomware will cost the world up to $20 billion in 2021 and is expected to be a greater concern with the hybrid work model. As a result, you’ll need to rapidly scale your security to account for the massive influx of remote and hybrid workers while simplifying and unifying your IT systems.

While implementing security controls is increasingly important, this also means more hardware appliances and virtual instances to secure different parts of the infrastructure. All this extra equipment and instances means more power consumption and heat dissipation, leading to adverse impacts on the environment. We’re taking steps to address this situation. There are a couple of ways we’re approaching this. Cisco products have security features which are built into our switches to prevent the need for separate security appliances.

Innovative methods to detect malware within encrypted layers

As an example, let’s look at the scenario where a traditional method of securing the deployment is used for decryption and identification of malware. As shown in Figure 1, you would first need to decrypt the traffic, then apply analysis (inspection / anti-malware), and finally encrypt the traffic again. The resulting power consumption is shown in Table 1.

Figure 1. Traditional deployment using Secure Sockets Layer (SSL) inspection

Table 1. Power consumption in a traditional deployment

As displayed in Table 1, the total power consumption for all the devices is close to 9500W. In the sustainable method we offer, the Cisco Secure Network Analytics (Cisco Stealthwatch) components like Stealthwatch Management Console (SMC) and Flow Collector (FC) are virtualized, which can be deployed on the existing X86 servers without needing the additional devices as shown in Figure 2.

Figure 2. Innovative and sustainable option using Cisco Secure Network Analytics (Stealthwatch)

In this scenario, Stealthwatch’s patented technology allows analysis of encrypted traffic without decryption. The ETA module in the catalyst switch provides Stealthwatch with the extra information for the analysis of the encrypted traffic without decryption.

Table 2. Power consumption using Cisco Secure Network Analytics with Catalyst switches

As the Stealthwatch components are virtual, they can be deployed in an existing X86 server, and the power consumption is minimal as compared to the dedicated appliances.

Another way Cisco caters to sustainable cybersecurity is by ensuring that the functionalities such as load balancing, packet broker functions, switching, and routing are all included in a single appliance.

Tables 3-4 highlight the difference between the traditional method and innovative new method for total power consumed for identifying malware in encrypted traffic:

Table 3. Traditional method power consumption

All the functionalities listed in Table 3 are now available in a single switch such as the Nexus NX 9300, which has the following power consumption:

Table 4. Power consumption using Cisco Nexus

This shows that there are alternate methods to detect malware within encrypted layers which are more sustainable, efficient, and less expensive compared to traditional deployments.

Source: cisco.com

Continue reading

O-RAN Plugfest 2021: Making 5G Adoption Cost-Effective for Brownfield Providers

5G adoption is causing mobile networks to grow at unprecedented rates. This brings with it significant new business opportunities but can also increase the complexity and cost of deployment and operations. An intelligent, programmable network enables communication service providers to take advantage of the growth that 5G offers while streamlining their operations to maximize return on investment.

Cisco is addressing these challenges head-on with our industry-leading NCS 500 portfolio. New enhancements enable simultaneous support of both traditional architectures RAN and open, virtualized RAN, with full interoperability.

Challenges for Brownfield Operators

Using an open architecture provides many cost benefits to service providers, leveraging a Commercial Off-the-Shelf (COTS) based infrastructure, automation features, and an open ecosystem to promote a competitive market.

While it is relatively easy for greenfield service providers to adopt 5G open RAN interfaces and architectures, it is extremely difficult for brownfield operators who have already widely deployed 4G.

One of the main challenges for brownfield operators is the lack of interoperability available when using legacy RAN interfaces with an open RAN solution. Replacing all existing 4G CPRI radios in the network with eCPRI based radios is not feasible, which makes adoption of an open RAN and DU virtualization very difficult.

When 4G and 5G are being deployed in the same cell site but running on two different architectures (proprietary 4G eNB and virtualized open 5G DU), it is cost-prohibitive for the provider.

Brownfield Interoperability

Cisco has been working with various Standard Development Organizations (SDO) to define an open and fully interoperable 5G RAN architecture.

Through collaboration, we were able to create a solution that could seamlessly integrate legacy radios on Cisco’s Converged SDN Transport architecture, while also standardizing the specifications to make it fully interoperable.

As a contribution to the O-RAN ALLIANCE, we drove the creation of an open Fronthaul gateway specification (O-RAN.WG7.FHGW-HRD.0-v02.00) to address deployment challenges for brownfield providers. This specification allows legacy CPRI based radios to communicate with open RAN 7.2x eCPRI based DU.

Cisco NCS 540 Fronthaul Routers, a key element to the Converged SDN Transport architecture, provide an open and programmable solution to host RAN network functions like Fronthaul Gateway (FHGW) and RAN resource configuration.

O-RAN PlugFest in India

We were able to demonstrate this successful integration during the O-RAN Global PlugFest 2021 hosted by Bharti Airtel in India. Through our multivendor demo, Cisco NCS 540 platform hosted the FHGW network function provided by VVDN technologies and verified the solution using Keysight Open RAN Studio and Signal Analyzer.

Fig: O-RAN PlugFest demo setup at Bharti Airtel

Cisco’s solution approach is vendor agnostic, helping service providers to consolidate functions, optimize network inventory, and reduce the cost of deployment.

FHGW allows seamless integration of legacy radios to ORAN 7.2x DU enabling operators to adopt ORAN architecture for existing 4G networks. Although the FHGW is deployed at the cell site, it can provide approximately nine times the optimization to transport bandwidth in a centralized RAN architecture.

Open hardware and API definition helps overcome proprietary dependencies of RAN functions and allows seamless integration in a multi-vendor environment.

A programmable platform promotes innovation and protects investment. The same platform can be programmed to function as a Fronthaul MUX / De-MUX for shared cell deployment.

Joint European O-RAN and TIP PlugFest

Cisco also participated in the O-RAN European PlugFest 2021 hosted by TIM OTIC laboratory in Torino, Italy. We were challenged to build two end-to-end, interoperability solutions leveraging multi-vendor O-DU / O-CU radio software components and O-RU elements for both 4G (LTE B7) and 5G (n3, n78).

In both cases, the NCS 540 Series Router was used to provide packet-based fronthaul to connect O-RU to O-DU and to distribute timing and synchronization taken from the TIM network to O-RU using PTP and SyncE protocols according to the O-RAN LLS-C3 model.

We successfully demonstrated compliance to O-RAN transport characteristics in multivendor environments including time synchronization, packet fronthaul, latency and jitter, telemetry, and packet-based fronthaul network automation.

Powering Open, Virtualized RAN in Brownfield Deployments Today

As service providers continue to deploy 5G, the benefits of adopting a virtualized RAN are becoming increasingly evident. By providing secure and zero-touch infrastructure over a resilient transport architecture, we can simplify the deployment of virtualized DU servers at cell sites.

Virtualized infrastructure requires the following interfaces for management and zero-touch operations:

1. Out of Band (OOB) interface for server management and infrastructure onboarding

2. The management interface for server, radio, and virtual DU OAM

3. Management interfaces for Kubernetes or virtual machine infrastructure and container management.

Secure infrastructure using well-defined quality of service (QoS) is key to ensuring traffic protection and traceability in a multivendor environment. Cisco NCS 540 Series Routers are based on proven hardware and software, which is necessary to provide a secure environment for cell site virtualization.

A mature QoS architecture provides traffic separation and defined service protection. Secure and encrypted algorithms support SSH, AAA, DHCP, ZTP, SNMP, IPv4/IPv6, MACsec, IPsec, gRPC, MPP, and rich access control list features.

Cisco secure zero-touch provisioning enables a secure automation framework not only for the router but also for virtualized DU and open Radio deployment at the cell site.

Programmability and Automation

Cisco offers a flexible and programmable architecture that service providers can begin to take advantage of today. With rich streaming telemetry support, networks can be monitored with streamed configuration and operational telemetry data on a centralized data virtualization tool. The platform provides extensive support for YANG and IETF Models, and OpenConfig.

With open management interfaces and APIs, we can enable end-to-end network management functions through the operational lifecycle of the brownfield cell site. Cisco offers off-the-shelf and customized Cisco Network Services Orchestrator (NSO) function packs to automate the provisioning of each mobile network domain including radio, virtualized functions, and transport.

Committed to Continued Innovation

Cisco continues to focus on technological enhancements that will help brownfield service providers reduce deployment costs. By providing a transport infrastructure that is open, programmable, secure, and verified against standards, we are empowering providers to seamlessly adopt virtualization and open, disaggregated RAN solutions in multivendor environments.

Source: cisco.com

Continue reading

Wi-Fi 6E: Changing the game for Sports and Entertainment venues

We hear a lot about how Wi-Fi 6E is going to change the way we work and play. With the ability to achieve higher throughput and lower latency due to more frequency availability and less congestion, combined with better security, Wi-Fi 6E has given us a new playbook of applications and use cases.

As a Distinguished Engineer in Cisco’s CX CTO organization, I spend a lot of time working within large public venues such as sports stadiums and music festival/concert venues to connect fans and create exceptional wireless experiences. I have the pleasure of working with professional sports leagues, Olympic Organizing Committee, U.S. Open, Live Nation, Clair Global and so many others to design, architect, and deliver networks capable of supporting the needs of tens of thousands of excited fans.  As an avid sports and music fan myself, it makes work fun!

Wi-Fi 6E connecting fans like never before

With the advent of Wi-Fi 6, we were able to make a huge difference in the efficiency and overall quality that Wi-Fi enabled venues provide to their guests. With the entry of Wi-Fi 6E, we take advantage of the same technologies and protocols but add the new 6 GHz band. This brings in stronger encryption (mandatory WPA3), better reliability, and most of all increased efficiency which leads to greater throughput. The E in Wi-Fi 6E is representative of the 6GHz band which further extends available spectrum and channels, providing much more space for devices. With its ability to carry more data than both 2.4 and 5 GHz, the 6GHz band allows fans to flawlessly stream and share their favorite moments.

OFDMA and Uplink MU-MIMO

Wi-Fi 6/6E makes use of Orthogonal Frequency-Division Multiple Access (OFDMA) and introduces Uplink Multiple-Input, Multiple-Output (UL MU-MIMO). These technologies provide the ability to deliver simultaneous bidirectional communication between Wi-Fi 6/6E access points and clients.  While MU-MIMO has been around since Wi-Fi 5, the ability to have clients utilize this on the uplink is new to Wi-Fi 6/6E.  This means more simultaneous users getting a better experience because the network can prioritize and schedule traffic and applications.

This is particularly important to the large stadiums and concert venues I spend a lot of time in. Uplink traffic typically far exceeds the downlink due to the number of connected users taking photos and videos and having those instantly uploaded to the cloud.  See below graphic from a recent event in a large stadium where the uplink traffic more than doubled the downlink traffic.

1200 MHz of wide-open spectrum

Wi-Fi 6E includes up to 1200 MHz of additional spectrum in the 6GHz band. The additional spectrum adds a ton more space for devices with plenty of channels. This helps us avoid the excessive collisions and contention for airtime that has become normal in these types of venues. In case you’re not aware, contention and collisions cause slow response times, introduce latency, disconnect devices from the network, and ultimately, drive less than positive experiences. Now apply this to large sports venues and music festivals and you can see how the additional spectrum allows fans to flawlessly stream and share their favorite moments without interruption.   It’s like adding a ton of additional lanes to a congested highway!

Something to keep in mind, some countries, such as the U.S. and Canada are allocating the entire 1200 MHz while others, only a portion. The below map is current from the date of this posting:

Source: Wi-Fi Alliance  https://www.wi-fi.org/countries-enabling-wi-fi-6e

OpenRoaming and Wi-Fi 6E: seamless and fast

Many of Cisco’s customers, especially those that specialize in entertainment, are jumping onto the OpenRoaming train. OpenRoaming, a technology developed by Cisco and standardized by the Wireless Broadband Alliance, enables seamless and secure connectivity to participating networks. Events such as Live Nation’s BottleRock and the USGA’s U.S. Open, to name a few, use OpenRoaming to automatically connect thousands of attendees to the Wi-Fi network without the use of usernames or passwords. Add in Wi-Fi 6E and its ability to support faster speeds and more devices, and you have the recipe for exceptional guest Wi-Fi experiences.

All in all, Wi-Fi 6E at large venues is a game changer that enables more devices to connect with less contention for space, increased speed, better reliability, and more robust security. It’s a match made in IT heaven.

Stay tuned for more on Wi-Fi 6E!

Source: cisco.com

Continue reading

Top Tips to Pass CCNP Enterprise 350-401 ENCOR Exam

With the constant evolution in technology, every organization worldwide requires an IT professional to help them remain at the top of the most advanced trends, increase their security, and boost overall performance. If you are presently creating your career in IT, you know how difficult it can be to obtain a Cisco certification. Yes, having one of these will unlock plenty of professional opportunities for you, but not every person tends to do this. The following section will focus on the CCNP Enterprise 350-401 ENCOR exam and explain everything you require to know.

CCNP Enterprise 350-401 ENCOR Exam Information

After passing the CCNP ENCOR exam, an applicant will hold the skills of troubleshooting, configuring, and operating wireless and enterprise wired networks. It is why this exam measures one’s skill in infrastructure, architecture, virtualization, automation, network assurance, and security.

The exam comprises 90 to 110 questions. The questions type is multiple-choice, and the exam takers have 120 minutes to answer them. You have to obtain 750-850 to pass the exam.

When it comes to candidates eligible for this exam, they require to hold relative knowledge and experience working on Cisco networks. It is why it is suggested that applicants hold some working experience. This isn’t a formal requirement, but it will be helpful if they are already familiar with the fundamentals. This CCNP ENCOR certification is the best fit for System Engineers and Integrators, Network Consultants, and Cisco Channel Partners. If you don’t hold this knowledge, you will first need to acquire all the skills evaluated on the CCNP Enterprise certification.

Top Tips to Pass CCNP Enterprise 350-401 ENCOR Exam

Let’s explore some tips for this Cisco exam preparation. Cisco certification exam passing ratio is very less, indicating that you will have to invest a lot of time and effort. It will expect you to dedicate four to five months for exam preparation. Yes, we perceive how frightening this may look, which is why you should enforce the following tricks.

Concentrate on the CCNP ENCOR Exam Topics

The first thing you have to do is find the complete list of CCNP ENCOR exam topics. Finding this syllabus is moderately simple. You just need to google search, and several results will give you. But without doubt, you should only visit Cisco’s official page and other trusted websites.

 Each of the topics is marked by percentage, so you will understand which requires more time and focus. You should study all of them.

Create a Study Schedule to Organize Your Studies

The key to passing this 350-401 ENCOR is organizing your studies. We understand that we have possibly devastated you a bit, but you will be good if you have sufficient time to commit yourself to this task and plan out every study session. So, make sure to investigate when the date of the exam is, and therefore, this is the first thing you have to learn.

Furthermore, think about your everyday life, and find a few hours a day to study. Yes, this can be a challenge if you have a full-time job and a large family, but you have to do it. Even two hours per day will be sufficient. But, keep in mind that you require to concentrate completely, which means no disturbances. Make a realistic study schedule and follow it no matter the temptation.

Collect the Relevant Study Resources

The next step to take in your CCNP ENCOR exam preparation is obtaining essential study resources. You should start with the Cisco 350-401 study guide. And make sure you read it at least two times. This study guide will equip you with all the essential information about the exam and includes exam questions.

Best Study Resources for Cisco 350-401 ENCOR Exam Prep

Moreover, it may also be great to make short notes after going over each topic. Some people don’t like this approach, but it can be helpful. Not only will you be able to determine how much you have grasped, but these notes will be a superb tool for the final revision.

Cisco 350-401 ENCOR Practice Test

Taking the CCNP ENCOR practice test is the best way to gauge your learning. You can find many websites providing online practice tests for Cisco exam preparation, such as NWExam.com. At the same time, you can perform practice tests to gauge your skills during the whole process of prepping. This way, you will comprehend whether you have to go over definite topics again.

Online Training Courses

If it appears to you that you cannot be prepared for this exam by self-studying approach or simply that you won’t be very effective on your own, there are always online courses you can take up. Yes, you will have to pay some money for online training courses, but keep in mind that they will ultimately pay themselves off. You will get a tone of other study resources and collaborate with experts who will help you master every tough topic.

Online Communities

If you like to study in a group, there are a large number of online communities and blogs where you will get in touch with people who are preparing for the same exam as you are. You can connect with other applicants to study and solve each other's doubts. What’s more, this way, you will also meet the professionals and people who have passed Cisco 350-401 ENCOR exam, so you will get first-hand information.

Conclusion

Passing the 350-401 exam and achieving the chosen Cisco certification helps you boost your career. Becoming Cisco certified will allow you to get better-paid jobs in international organizations due to your new coveted skills.

Continue reading

[New] Cisco 300-735 CCNP Security Questions and Answers with 300-735 Exam Topics

 

Cisco 300-735 SAUTO Exam Description:

The Automating and Programming Cisco Security Solutions v1.0 (SAUTO 300-735) exam is a 90-minute exam associated with the CCNP Security, Cisco Certified DevNet Professional, and Cisco Certified DevNet Specialist - Security Automation and Programmability certifications. This exam tests a candidate's knowledge of implementing Security automated solutions, including programming concepts, RESTful APIs, data models, protocols, firewalls, web, DNS, cloud and email security, and ISE. The course, Implementing Cisco Security Automation Solutions, helps candidates to prepare for this exam.

Cisco CCNP Security 300-735 Exam Overview:

• Exam Name- Automating and Programming Cisco Security Solutions
• Exam Number- 300-735 SAUTO
• Exam Price- $300 USD
• Duration- 90 minutes
• Number of Questions- 55-65
• Passing Score- Variable (750-850 / 1000 Approx.)
• Recommended Training- Implementing Automation for Cisco Security Solutions (SAUI)
• Exam Registration- PEARSON VUE
• Sample Questions- Cisco 300-735 Sample Questions
• Practice Exam- Cisco Certified DevNet Specialist Security Automation and Programmability Practice Test
  

Must Read:-

1. How to Breeze Through CCNP Security 300-735 SAUTO Exam?
2. Tips to Get Flying Score in CCNP Security 300-735 SAUTO Exam

Practice Now:-

Continue reading

Relevant and Extended Detection with SecureX, Part Two: Endpoint Detections

In part one of this series we introduced the notion of risk-based extended detection with SecureX – the idea that a user can prioritise detections into incidents based on their idea of what constitutes risk in their environments and then extend those detections with enrichments from other products. In subsequent posts we are diving deeper into different Cisco Secure detection technologies and how their respective detections can be prioritised, promoted to SecureX as incidents and extended. In this post we will look at detections from Cisco Secure Endpoint: what makes them relevant and important, the new automatic promotion feature and the triaging of endpoint events in SecureX.

What Makes an Endpoint Detection?

We’re digging into Endpoint Detections first for a Reason: Endpoint Detection and Response (EDR) solutions, like Cisco Secure Endpoint, have been central to Security Operations and Incident Response teams for years. In fact, when performing research with many of our security operations customers earlier this year we found that a majority of customers treat detections from their EDRs as their highest fidelity level and automatically put endpoint derived detections at the front of their incident response queues.

There are multiple reasons for why Endpoint Detections are so valuable to SecOps:

◉ Endpoint Detections are high fidelity:

   ◉ The nature of residing on an endpoint allows the detection system to be accurate in describing what is being seen. The observables and Indicators of Compromise (IOCs) in an endpoint detection (ex. Filename, file hash, hostname, URL) are typically accurate in what they are observing and explaining

◉ Endpoint Detections are explainable:

   ◉ Many of the detections generated by endpoint solutions link back to a file hash and threat intelligence with an explanation of what that file is and does, what the risk is to the asset that it is on, and the level of risk to the organization as a whole.

◉ Existence of Endpoint data itself provides insight:

   ◉ This intuitively obvious statement derives from the fact that the reason there is an endpoint detection in the first place is that it came from an agent that was installed on an owned asset. You don’t tend to go to the effort of installing and managing agents on unowned or non-valuable assets and on top of that in the very nature of installing the agent the asset became more valuable.

Just because an EDR can detect something, doesn’t mean that all detections are equal: understanding what the threat is, its risk to the device it’s on, the risk to the data on the device and the risk to the rest of the organization all are factors in determining how important the detection is. One of the most common, yet most overlooked components of what makes an endpoint detection important is security policy, for example forbidden applications. Applications can be forbidden for numerous reasons, from internal policy to government regulations, but those custom detections can be the most informing and actionable to a security operations team. In the example Simple Custom Detection from Cisco Secure Endpoint below we can see adding the SHA-256 of tor.exe to a simple custom detection on the left and the occurrence of that detection on the right.

Figure 1 – Configuration of Simple Custom Detection to detect tor.exe

Figure 2 – Occurrence of detection of tor.exe

In the detection occurrence figure above, at the top right, you might notice the label “Medium” indicating the severity of the threat detected. The notion of Severity was introduced to Cisco Secure Endpoint in the fall of 2018, providing a new setting for an analyst to leverage in prioritising events.

In Cisco Secure Endpoint there are four severity tags that can be applied to a given event; these severity tags are assigned by Cisco threat research team based on the global threat landscape knowledge and are continuously tuned to maintain a high level of accuracy. Since their introduction, we have found the below security events to be very useful in allowing Cisco Secure Endpoint customers to prioritise events and sort their inboxes using the severity tag and what it indicates:

◉ Critical – involving known malware families identified with very high precision

◉ High – generic malicious behaviors and generic malware, not attributed to a particular family

◉ Medium and Low – possibly malicious or risky detections, that could indicate about a potential compromise or degraded security posture

A new feature of both Cisco Secure Endpoint and Cisco SecureX is the ability to have Critical and High Cisco Secure Endpoint events automatically promoted as Incidents in Cisco SecureX Threat Response, allowing for the extension and prioritisation of Cisco Secure Endpoint detections.

Extending an Endpoint Detection:

In addition to the ability to automatically promote Critical and High Secure Endpoint events into Threat Response as Incidents is the creation of the notion of a High Impact Incident in Threat Response. The High Impact Incident List, an example seen below, are Incidents that are perceived to be of the highest criticality and importance to a security operations center. You will note in the screenshot below that there are two Incidents that appear in the High Impact Incident List and an additional 6,063 as Other Incidents: this is the process of identifying those incidents that are deemed to be the most critical, highest risk to the organization. In its first iteration the incidents that make their way onto the High Impact Incident list are those that are promoted from Cisco Secure Endpoint. As previously mentioned, we’ve found that Security Operations Centers tend to prioritise endpoint detections for numerous reasons.

In the above figure you might notice that labels “Enriched” and “Enriching” next to the two Incidents in the High Impact Incident list. Another recent enhancement is the automatic enrichment (or extension) of the incidents that are in the High Impact Incident List. What is happening behind the scenes is Cisco Threat Response is searching all integrated products for additional details about the attributes in the incident.

As we explored in the first part of this series, in the Orient stage of the OODA loop you are enriching or extending a detection. Potentially more important than the details about the file involved in the endpoint detection are the external factors such as:

◉ What role does this device have in my organization?

◉ Who is the user on the device?

◉ What other devices might be involved in the incident?

◉ What external knowledge is there of the threat?

◉ How often is this threat seen?

And, any other detail that might be used to assess the business risk of the detection.

By automatically enriching these High Impact Incidents with data from other integrated products we are shortening the Orient step portion of the OODA loop considerably, speeding up that mean-time-to-respond.

Once it has finished enriching, if we click on the top Incident in the High Impact Incident list and then on Linked References, we can see the Snapshot that was created during the enrichment process and that there were nine different observables investigated across multiple data sources integrated with SecureX Threat Response.

Opening the automatically created Snapshot takes us to an investigation in Cisco SecureX Threat Response. We can quickly see that not only the original device – w7-hoser – is involved but also another device on the network – w7-darrin – and that both have communicated to the same known malicious external IP addresses. If you look closely at the SHA-256 in the centre of the image you might notice that it is the same SHA-256, for tor.exe, that we used earlier to create a Simple Custom Detection.

From here we have a wealth of information for a given High Impact Incident:

◉ We know the hosts involved

◉ We know they are using banned applications

◉ We know some external threat intelligence

And, we can use that information to quickly make a decision that would frame our response action, quickly tightening our OODA loop.

In this post we’ve reviewed some concepts behind what makes an endpoint detection, why they’re valuable, and how to leverage Cisco SecureX to automatically extend the detection and create a High Impact Incident in SecureX Threat Response. Future posts in this series will explore the different integrated products in SecureX and how their detections can be promoted, enriched, and extended in SecureX. In the next post in this series, we will begin with the automatic promotion and triaging of behaviour detections from Cisco Secure Network Analytics into Cisco SecureX.

Source: cisco.com

Continue reading

Cisco and Intel: Next-Gen Wireless Client Visibility with Intel Connectivity Analytics!

Introducing Intel Connectivity Analytics

Cisco and Intel present a new analytics solution, Intel Connectivity Analytics, that gives granular driver-level wireless client insights for any client using the latest Intel driver and wireless chipsets while connected to a supported Cisco wireless network (visit Intel Connectivity Analytics FAQ for the SW/HW compatibility matrix). This feature significantly impacts the enterprise PC vertical, where Intel Wi-Fi 6/6E chipsets make up the majority of the market share. With the Intel Connectivity Analytics capability built directly into the Intel wireless drivers, it eliminates the need to install any client-side agent, enabling this feature to be leveraged in even non-corporate settings.

More than just telemetry, Intel Connectivity Analytics provides intelligent reports that allow network administrators to understand what to do next for any problem and ensure a great user experience in even the most complex wireless deployments by addressing the use cases in Figure 1 below.

Figure 1. Intel Connectivity Analytics Use Cases

Six Intelligent Reports to Solve All Your Problems

Intel Connectivity Analytics generates six reports (Figure 2) in real-time based on information forwarded by wireless clients to the AP and then Cisco Catalyst controller or Meraki Dashboard that directly addresses the use cases depicted in Figure 1.

Note: Station information, Neighboring AP, and Failed AP reports are generated at client association, while others are triggered when the situation arises.

Figure 2. Intel Connectivity Analytics Reports Details

Identifying out-of-date Driver, Validating New Drivers, and Identifying Hardware issues:

The Station Information report provides network administrators with driver-level client information that would not have been available in typical telemetry. This additional information allows network administrators to pinpoint the specifications such as software driver or hardware model that clients experiencing poor Wi-Fi are on and target just them.

Figure 3. Identifying Hardware Issues with Intel Connectivity Analytics

Figure 4. Station information or Device Classifier WebUI Output on the Catalyst 9800 Controller

Outdated wireless drivers can also be a common culprit for a poor wireless experience. The station information report gives network administrators peace of mind when rolling out software updates knowing they have complete visibility on the Catalyst or Meraki controller.

Figure 5. Identifying Out of Date Drivers (Left) & Validating New Drivers (Right) with Client Connectivity Analytics

Troubleshooting Roaming:

When a client roams, it’s entirely a wireless client’s decision to do so, and the network has little to no visibility into the reason. Thanks to Intel Connectivity Analytics, we have reports that will share these insights with reason codes such as Low RSSI, 11v Recommendations, Missed Beacons, and Better AP. Based on these insights, a network administrator can determine whether the suspicious client roam was for a legitimate reason or not.

Figure 6. Troubleshooting Roaming with Client Connectivity Analytics

Figure 7. Roaming Scenario Report WebUI Output on the Catalyst 9800 Controller

Identifying Poor Connectivity:

When a wireless client’s RSSI falls below a certain threshold, a Low RSSI report will be generated to alert network administrators about possible coverage holes. These issues can then be proactively addressed by increasing the Tx power on an AP, deploying additional APs, and monitoring if more Low RSSI reports are generated.

Figure 8. Identifying Poor Connectivity with Client Connectivity Analytics

Identifying Misbehaving APs:

Intel Connectivity Analytics supported clients will report if an AP is broadcasting invalid IEs in their beacons, probes, and association responses that would cause connectivity and security concerns. In fact, failed AP reports will even go deeper at the packet level and highlight problematic authentication frames, association frames, or missing response frames.

Intel Connectivity Analytics can even detect rogue AP behavior with the Unknown AP report, which is used to identify and flag rogue BSSID’s (BSSIDs that are not part of an earlier neighbor report)

Figure 9. Identifying Misbehaving APs with Client Connectivity Analytics

Figure 10. Unknown AP Report CLI Output on the Catalyst 9800 Controller

How Does It Work?

Intel Connectivity Analytics uses a Cisco Catalyst 9800 series controller and Catalyst 9100 access point topology from the Cisco Enterprise Network side. The controller enables the features by default on a per WLAN basis. Intel Connectivity Analytics supported client sends the driver-level telemetry back to the access point, which is then processed and presents users with intelligent reports and insights.

Figure 11. Intel Connectivity Analytics Topology

For a technical understanding, refer to the following points:

1. All Intel Connectivity Analytics packet exchanges are protected using PMF for security purposes.

2. Cisco network running IOS XE 17.6.1 or later with the feature enabled will advertise Intel Connectivity Analytics feature support in the Beacon frames.

3. Supported Intel clients will detect and begin forwarding telemetry periodically via a protected Action frame.

As you can see, Intel Connectivity Analytics provides network administrators with granular client-side telemetry in an agentless package at a level never seen in the past. With its wide range of use cases, minimum day 0 requirements, there’s no reason why you wouldn’t leverage such a powerful wireless analytics solution! Take the wireless experience of your network to the next level with Intel Connectivity Analytics today!

Source: cisco.com

Continue reading