Cloud-Managed Security for Distributed Networks with · Over 2 million Meraki network devices online ... Network design Network capacity limits Address with training, more infrastructure

Cloud-Managed Security for Distributed Networks with Cisco Meraki MX

Joe Aronow, Product Architect

PSOSEC-1055

© 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public

Cisco Spark

Questions? Use Cisco Spark to communicate with the speaker after the session

1. Find this session in the Cisco Live Mobile App

2. Click “Join the Discussion”

3. Install Spark or go directly to the space

4. Enter messages/questions in the space

How

cs.co/ciscolivebot#PSOSEC-1055

About the Cisco Meraki MX


A complete cloud managed IT solution

Wireless, switching, security, SD-WAN, communications, EMM, and security cameras

Integrated hardware, software, and cloud services

Leader in cloud managed IT

Among Cisco’s fastest growing portfolios

Over 140,000 unique customers

Over 2 million Meraki network devices online

Simplifying IT with cloud management

5PSOSEC-1055


A complete cloud managed IT portfolio

Single pane of glass management

Systems Manager

EMMMC

IP Telephony

MR

Wireless

MS

Switching

MX

Security and WAN

MV

Security Cameras

The Meraki full stack

6PSOSEC-1055


Application Control

Bandwidth shaping

URL content filtering

Quality of Service control

Security

Next generation firewall

AES encrypted VPN

Intrusion prevention (IPS)

Malware protection

Geo-IP firewalling

Networking

3G / 4G failover

Branch routing

WAN balancing and failover

High Availability

Intelligent path control

A complete connectivity and threat management solution

7PSOSEC-1055


Powerful security that’s easy to implement• Robust suite of Cisco Security technologies

• Intuitive GUI-based configuration

• Seamless updates from the cloud

Industry-leading visibility• Fingerprints users, applications, devices, and threats

• Monitor one location or an entire deployment

• Unified monitoring and reporting with other Cisco Meraki

technologies

Exceptional scalability• Zero-touch provisioning with cloud brokered VPN

• Easy centralized management with built-in remote

troubleshooting tools

• Multi-location configuration templates

Why customers choose the Cisco Meraki MX

8PSOSEC-1055


Next Generation Firewall Application aware firewalling

Intrusion Prevention

(IPS)Based on Cisco Snort

URL Content FilteringWith over 80 categories and

over 4 billion categorized URLs

Geo-based security Allow or block traffic by country

Malware Protection Cisco AMP and Threat Grid

Automatic updatesSoftware and security updates

delivered from the cloud

PCI compliancePCI 3.2 certified cloud

management backend

Ironclad security

9PSOSEC-1055


1.5 million malware

samples / day

600 billion email

messages / day

16 billion web requests

/ day

Honeypots

Open source

communitiesInternal

vulnerability discovery

Telemetry

Internet-wide scanning

Over 250 full time

threat researchers

Millions of

telemetry agents

4 global data

centers

Over 100 threat

intelligence partners

Over 1100 threat

traps

Backed by Cisco Talos threat intelligence

10PSOSEC-1055


Dual uplink ports2 uplink support on all MX models for load balancing

and redundancy

LTE failover USB modem support in all models with automatic

failover

Site to site VPNCloud orchestrated VPN (Meraki Auto VPN) with load

balancing and self-healing capabilities

Intelligent path

control

Policy based routing and performance based dynamic

path selection

Branch Routing

Automatic route distribution via Auto VPN

OSPF route advertisement

BGP support coming soon

High Availability Active/passive hardware redundancy

Traffic shaping Application bandwidth limiting and prioritization

Reliable, cost effective connectivity with Meraki SD-WAN

11PSOSEC-1055


Simple Create VPN tunnels between locations with easy point-and-click interface, or apply

configuration templates to enable and configure VPN at many locations at once

Automatic VPN configuration generated and deployed automatically from the cloud – create a

mesh or hub-and-spoke topology with only a few clicks

Resilient Automatically adjusts to changes in order to maintain secure connectivity during an

ISP or datacenter outage, hardware failure, or IP address update

Automated site-to-site VPN (Auto VPN)

12PSOSEC-1055


Dual active VPNLoad balance your VPN traffic over your hybrid

WAN

Policy based routingSelect the preferred path for traffic based on

protocol, port, source and destination IP, or

even application

Dynamic Path SelectionSelect the best VPN tunnel for traffic

automatically based on performance

The only solution to combine cutting edge SD-WAN

with industry leading security technology

Application-aware intelligent path control

13PSOSEC-1055


Auto VPN

SD-WANBranch

Datacenter 2

Datacenter 1

AWS vMX

Extend Auto VPN and Meraki SD-WAN into AWS / Azure

14PSOSEC-1055


Cisco Meraki MX Cisco Firepower & ASA

Existing Meraki customer

Prizes simplicity first / “Lean IT” organization

Needs high WAN performance with low cost Internet links (SD-WAN)

Existing Firepower, TrustSec, AMP for Endpoints customer

Needs sophisticated threat investigation

Enterprise edge deployment

Datacenter

Branch or distributed enterprise deployment

Internet edge

Network Security use cases

15PSOSEC-1055

What’s new


Expanding the MX portfolio with new, high performance options

High Throughput Modular redundant powerFlexible Interface types

PSOSEC-1055

MX250 and MX450 Security Appliances

17


MX250 MX450

Firewall Throughput 4 Gbps 6 Gbps

VPN Throughput 1 Gbps 2 Gbps

Recommended Clients 2,000 10,000

Interfaces

8 x 1G RJ45

8 x 1G SFP

8 x 10G SFP+

WAN

LAN

2 x 10G SFP+

8 x 1G RJ45

8 x 1G SFP

8 x 10G SFP+

2 x 10G SFP+

PSOSEC-1055

MX250 and MX450 Security Appliances

18


Meraki Z1 Meraki Z3

WAN 1 x 1GbE 1 x 1GbE

LAN 4 x 1GbE 4 x GbE (1 x PoE)

WLAN 802.11n 802.11ac wave 2

Firewall Throughput 50 Mbps 100 Mbps

VPN Throughput 10 Mbps 50 Mbps

802.1x port authentication No Yes

Vertical desktop mount No Yes

Recommended clients 5 5

New

PSOSEC-1055

Z3 Teleworker Gateway

19


Virtual MX now available for Microsoft

Azure

•500 Mbps VPN throughput

•Available in Azure Marketplace

•Full SD-WAN capabilities

•Same license

PSOSEC-1055

vMX100 for Azure

20


Security

Threat Grid

FQDN/hostname firewall rules

Syslog export of AMP events

DNS-based Google safesearch and Youtuberestriction (Google’s recommended method)

“Full list” URL filtering cloud lookups for HTTPS flows based on cert request

New release candidate firmware: MX 13.28

Connectivity

Layer 7 SD-WAN policies

OSPF advertisement on LAN of NAT mode MX

1:Many NAT over AutoVPN

BGP for VPN route redistribution

Uplink IP configuration from Dashboard

MX load monitoring

Loss and Latency reporting (Uplink SLA) capabilities now enabled in Passthrough mode

PSOSEC-1055 21

Introducing Meraki Insight


“The network is slow”

“My Wi-Fi is broken”

“My Internet is down”

“This is IT. How can I help?”

PSOSEC-1055

Sound familiar?

22


LAN congestion

Rogue actors

Network design

Network capacity limits

WAN congestion

Application errors

Application server processing time

Authentication / DNS server response time

Inte

rnal

Exte

rnal

Deploy Meraki Dashboard Tools (Traffic shaping, QoS, Air Marshal)LAN congestion

Rogue actors

Network design

Network capacity limitsAddress with training, more infrastructure

WAN congestion

Application errors

Application server processing time

Authentication / DNS server response time

Apply Meraki Insight

PSOSEC-1055

What contributes to poor end user experience?

23


• Provides end-to-end visibility into how your end-users are experiencing their SaaS

applications.

• Assists with application performance management and troubleshooting.

QUESTION: How does this differ from what is built in?

• This offers data for external factors, including the entire Wide Area Network, ISPs and

SaaS applications like Office 365, Salesforce.com, etc…

• Similar to 3rd party tools such as SolarWinds, Netscout, ThousandEyes

PSOSEC-1055

Meraki Insight

24

© 2018 Cisco and/or its affiliates. All rights reserved. Cisco PublicPSOSEC-1055

Meraki Insight in the dashboard

25


Insight into both the

network and application

layers

PSOSEC-1055


26



27


Meraki MX

PSOSEC-1055

Our first probe for Meraki Insight

28

Cisco Security Integrationsand portfolio positioning


Threat IntelligenceAnalytics and Insights Cloud and Web Security

Network InfrastructurePosture and Policy Malware

Intrusion Prevention

Endpoint Management

Security Architecture

Meraki MXFirewall

Remote Access

Cisco ISE

and TrustSec

= Active development or beta= Limited integration or interoperability = Deeper integration

31PSOSEC-1055


Integration details

• NetFlow export from MX can be consumed by Stealthwatch or Stealtwatch Cloud

Key limitations

• No Flexible NetFlow

• No NAT flow stitching

PSOSEC-1055

Current integrations - Stealthwatch

32


Network-wide > General

33


Integration details

• RADIUS authentication using ISE for wired connections on all MX64/MX65/Z3 models

• RADIUS authentication using ISE for wireless connections on MX64W/MX65W

Key limitations

• No TrustSec capability on MX

PSOSEC-1055

Current integrations - ISE

34


ISE / Meraki feature compatibility matrix

35


Integration details

• Use Umbrella resolvers for DNS resolution when serving DHCP from MX

Key limitations

• No eDNS forwarding capability

• No visibility into applied Umbrella policies in Meraki Dashboard

PSOSEC-1055

Current integrations - Umbrella

36


Security Appliance > DHCP

37


Integration details

• AMP for Networks with Threat Grid sandboxing on MX

• Native malware event visibility in Meraki Dashboard via Security Center

• Retrospective alerting via Dashboard and email alerts

Key limitations

• No correlation/trajectory between AMP on MX and AMP for Endpoints

• Only files downloaded via HTTP are inspected on MX

PSOSEC-1055

Current integrations - AMP

38


File Analysis

File RetrospectionFile Reputation

AMP

Cloud Threat Grid

AMP

Cloud

Service

Function

Powered by

Blocking of known

malicious files

Behavior analysis of

unknown files

Retrospective alerting upon

disposition change

*Trigger

1 2 3

PSOSEC-1055

AMP and Threat Grid integration with MX

39


File Analysis

File Reputation✓ ✖ ?

HostWebEmail

Network Attached

Controls

NGIPSNGFW ISR

Meraki MX

ESA / CES WSA / Umbrella Endpoint

StealthwatchISE

Threat

Intelligence

AMP CloudFile Reputation

Threat GridFile Analysis

Threat

Intelligence

PSOSEC-1055

Architecture

40


• Aggregated view of security events:

File Analysis and Disposition Changes

• Quick drill into file analysis results

• Event filtering capabilities

Meraki Security Center events

41PSOSEC-1055


Aggregated view of

security events

Quick drill into file

analysis results

Identify clients and

networks that are

potentially infected

Meraki Security Center events

42PSOSEC-1055


Integration details

• Three curated IPS rulesets for detection or prevention

• Native IDS/IPS event visibility in Meraki Dashboard via Security Center

Key limitations

• No customization of IPS rule sets

• Single-packet flows will not be blocked due to Snort not being run in-line

PSOSEC-1055

Current integrations – Snort IPS

43


Organization > Security Center

44


Security Appliance > Threat protection

45


“Inbound”

• Talos threat research and intelligence informs Snort signatures and the AMP malware database used on the MX

“Outbound”

• Snort IPS telemetry data is provided back to Talos to inform threat research activities

• AMP lookup data from MXes is available to Talos, just like with other platforms

PSOSEC-1055

Two way communication with Talos

46

Demo

MX Product Portfolio


Next Generation Firewall

Site-to-site and client VPN

Intelligent path control

Link bonding and failover

Bandwidth shaping and QoS

Branch routing

Web caching

Active/Passive high availability

Enterprise License Advanced Security License

*additional Threat Grid subscription required

All enterprise features, plus

Content filtering (with Google SafeSearch enforcement)

Cisco Advanced Malware Protection

Snort IDS/IPS

Threat Grid integration*

Geo-based firewall rules

Simple, use case driven licensing

49PSOSEC-1055


New

Medium BranchSmall Branch

MX64 MX65

~50 users

802.11ac wireless & PoE

FW throughput: 250 Mbps

MX84

~200 users


MX100

~500 users


MX400

~2,000 users

FW throughput: 1 Gbps

MX450

~10,000 users


All MX devices support 3G/4G

MX250

~2,000 users


MX600

~10,000 users


New New

vMX100 for AWS & Azure


VPN & SD-WAN features

Large Branch, Campus or Concentrator Virtual

Teleworker

Z1 Z3

~5 users

802.11ac Wireless & PoE

FW throughput: 50-100 Mbps

New

MX portfolio

PSOSEC-1055 50


Cisco Spark

Questions? Use Cisco Spark to communicate with the speaker after the session

1. Find this session in the Cisco Live Mobile App

2. Click “Join the Discussion”

3. Install Spark or go directly to the space

4. Enter messages/questions in the space

How

cs.co/ciscolivebot#PSOSEC-1055


• Please complete your Online Session Evaluations after each session

• Complete 4 Session Evaluations & the Overall Conference Evaluation (available from Thursday) to receive your Cisco Live T-shirt

• All surveys can be completed via the Cisco Live Mobile App or the Communication Stations

Don’t forget: Cisco Live sessions will be available for viewing on-demand after the event at www.ciscolive.com/global/on-demand-library/.

Complete Your Online Session Evaluation

http://ciscolive.com/Online

http://www.ciscolive.com/global/on-demand-library/


Continue Your Education

• Demos in the Cisco campus

• Walk-in Self-Paced Labs

• Tech Circle

• Meet the Engineer 1:1 meetings

• Related sessions

53PSOSEC-1055

Thank you

Documents

Cloud-Managed Security for Distributed Networks with · Over 2 million Meraki network devices online ... Network design Network capacity limits Address with training, more infrastructure