Another aspect of secure network design
is to be able to control the traffic once we have
a authenticated a user, controlling
what that user is allowed to do, where they can go,
and so forth.
And a lot of that can be accomplished
with a next-generation firewall.
[MUSIC PLAYING]
So let's talk about what that means.
What is a next-generation firewall?
Is it referring to Star Trek?
No.
The next-generation firewall, which
has been out for like a decade in various forms
from various vendors, has the ability
to do more than just stateful filtering. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to do more than just stateful filtering.
Stateful filtering is when a user
on the inside of the network goes out,
and the firewall remembers who they
are as far as their packets and so forth.
And when the replies come back from the servers,
the firewall has statefully remembered their sessions
and dynamically allows return traffic.
Ta-da.
Stateful firewalls.
But that's not enough anymore.
It hasn't been for a while because we
have a lot of traffic that's happening at the application
layer that may be really bad.
For example, we could have Bob that's leaking out information.
He's gotten some content that he shouldn't be sending out, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
He's gotten some content that he shouldn't be sending out,
maybe some person-identifiable information about employees
or whatever or company secrets, and he's sending it out.
And we need something-- the firewall-- to have the ability
to take a look at the payload, regardless of the protocol that
is being used, and analyze and see what is going on there.
Or if Bob is going to websites that
wouldn't be in his best interest or against company policies,
a next-generation firewall has the ability
to take a look at the application layer and say, hey,
it's not just TCP, it's not just TCP port 80 going to a website. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's not just TCP, it's not just TCP port 80 going to a website.
It needs to take a look and see what that URL is.
And even if we have encryption, we
have a next-generation firewall that can say, you know what?
For certain sites, if Bob is going out with SSL,
I'm going to do a little intercept.
I'll have an HTTPS session between the user
and the firewall.
That way, the firewall can look at the naked traffic
for a moment, analyze it, and then send it on its way
with another encrypted tunnel or another encrypted HTTP session
going up to the server.
The key is that a next-generation firewall has
the ability to do things like that, like deep packet WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the ability to do things like that, like deep packet
inspection, looking at the details, analyzing the content,
and making decisions, not just decisions on,
hey, that's a bad URL, meaning it's a risky website or a site
you shouldn't be going to, but also
information such as getting intelligence from the cloud.
So a next-generation firewall, like a Firepower Threat Defense
appliance and the Firepower Management Center
that manages the whole thing, it can get intelligence
from the cloud about the reputation of an IP address
or a group of IP addresses.
And that way, it can increase its risk WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that way, it can increase its risk
or increase its ability to say, you
know that might be a bad idea to go to that site
or put up bigger defenses against those source IP
addresses if they're trying to come into the company
from those blocks of addresses.
So in the case of controlling traffic,
one aspect is to use firewalls.
It is also very important to analyze that traffic
and to control it with next-generation firewalls.
And also with Firepower, there's also really great IPS as well--
intrusion prevention.
So as that traffic is coursing through the veins
of the network, we have the ability to analyze that traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of the network, we have the ability to analyze that traffic
and see, hey, is this harmful traffic.
Is this an attack?
And to help identify that before it becomes--
or before that traffic gets too far into our network.
So that's one of the aspects I wanted
to share with you in this design section regarding components
of a good design for security in a network.
And that is to have a firewall, not just any firewall,
a next-generation firewall that can do application layer
inspection.
It can identify traffic and permit or deny traffic
based on associating a user, like Bob, with whatever
IP address Bob's using.
And if we have a firewall that is allowing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And if we have a firewall that is allowing
certain types of traffic for Bob, how
do we keep that traffic secure?
And in a larger environment with lots
going on, how do we keep our security policies straight?
Well, there's another couple set of options
I want to share with you as far as the design goes.
And that is a concept called TrustSec and MACsec.
And we'll take a look at those in the very next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.