If you've been following along with this playlist,
you learned a lot about endpoint visibility
when we talked about streaming telemetry.
Now what about those remote clients, though, the people
who were working from home?
Using AnyConnect, we can still stream telemetry
into a collector that's ready to receive this data about what's
really going on on that endpoint.
And then we can view and get more visibility
into what's going on within our HQ, as well
as our remote offices, using the AnyConnect Network Visibility
Module.
Let's talk a little bit more about how this works. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's talk a little bit more about how this works.
Now, the AnyConnect NVM or Network Visibility Module
is a way that we can take our AnyConnect posture
assessment and installation and turn it up a notch,
put it on steroids, because what we're now doing
is basically turning AnyConnect into a flow collector
and sending our NetFlow data into a different collector,
so we can analyze what type of traffic
is exactly happening on each AnyConnect session.
Now here's the thing, when AnyConnect is working with us, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now here's the thing, when AnyConnect is working with us,
this is basically like an add-on that we plug in to AnyConnect,
so that we can start collecting NetFlow information
and sending it to a specific collector.
And in a lot of cases, in a lot of ways,
they use something like Splunk to be the NetFlow collector,
an analysis tool, but you could absolutely use something
like Cisco's Stealthwatch, so that way, our remote users, who
are accessing our corporate resources,
are now having their traffic as they're
connected to AnyConnect monitored
and streamed into Stealthwatch.
And it can use ML, like Machine Learning, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it can use ML, like Machine Learning,
or AI detect any anomalies in how that remote session is
actually taking place.
A great way that you can actually get familiar with this
is right here on the screen.
We actually have the install and configure components
for Splunk.
But again, this works just fine with Stealthwatch.
I really prefer this, though, because it's
got a great diagram right here, so you
can see how this really works.
We have our end users, who are teleworking,
and they're trying to connect over
the internet into our firewall via AnyConnect.
Of course, the firewall could be a Firepower Threat Defense WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Of course, the firewall could be a Firepower Threat Defense
device or an ASA.
But then from here, because we've enabled the AnyConnect
connector, the NVM for Splunk add-on,
it allows them to have the access
to the Lan users and the corporate resources,
like the HQ server.
But it's also streaming that flow data into the Splunk
collector, so we have the collector device,
and then we actually have the front end,
where we manage and monitor the NetFlow data.
Again, this is just a component to AnyConnect, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Again, this is just a component to AnyConnect,
as well as a component to whatever your network
monitoring solution is.
So this is something you can use in conjunction with AnyConnect,
as well as Stealthwatch, so that you get advanced analytics
in understanding what the infrastructure that we don't
control, the remote workers infrastructure, is really like
and what are they doing when they
get connected to AnyConnect.
This will help us find anomalies, like when a username
or password gets compromised, and all of a sudden,
we're getting AnyConnect concessions
from one user on a different end of the world. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
from one user on a different end of the world.
So maybe my end user account, I'm
connected in from Louisiana, but then
all of a sudden, my credentials are used to log in from Tokyo.
Clearly, there is a problem going on there.
And using Stealthwatch in conjunction with this,
we can catch these types of things
when they happen and stop them.
So that's been the AnyConnect Network Visibility Module.
I hope this has been informative for you.
And I'd like to thank you for viewing.