So as we begin our discussion of the beautiful tool called 40 Analyzer, let's
also take a minute
and let me review this topology with you which we'll be using throughout this
course. So here I've
got four firewalls or 440 gates. I've got one called HQ firewall one right here
. I've got one
called HQ firewall two right here one called HQ firewall three right there. And
over here I have
a branch firewall and it also has an HA pair which I think at the moment maybe
offline but in any case
I've got a firewall here at the branch office as well. Now for instructions on
how to configure the
40 gates themselves and configure them and their policies. We have separate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
40 gates themselves and configure them and their policies. We have separate
content here at CBT
nuggets on that topic as well. And as we continue together in this 40 analyzer
course we're going
to be focusing on the integration of the use of this tool right here called 40
Analyzer. So let's
begin with the purpose. Why would we even want to have this device called 40
Analyzer? Well one of
the main benefits of having a 40 Analyzer it can act as a central clearing
house for all of our
log information coming from not just 40 gate firewalls but also lots of
different for net devices. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
different for net devices. So
we're all right out centralized logs and that way you and I we can log in to 40
Analyzer and they'll
have those logs from all of our devices. So we have a single pane of glass
where we can look at and
analyze and do investigations regarding all the log messages coming from our
for net devices. Now
in order to get those logs from these devices over to the 40 Analyzer we're
going to do a couple
things. Number one we're going to register our devices for example firewall two
firewall three
firewall one the branch firewall will register all those with the 40 Analyzer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
firewall one the branch firewall will register all those with the 40 Analyzer
and that way not
just any device can go ahead and send logs they'll have to be registered where
the 40 Analyzer is
accepting those log messages and then at the 40 Analyzer it can buffer and
organize and keep all
that information regarding the logs and then what we can do so this is us right
here. Us as
administrators can then go ahead and log in to 40 Analyzer to do the
investigation we can view
and search the logs we can drill down into the details and also create reports
instead of automated
reports regarding what's happening in our environment. And one of the major
benefits of having all that
data right here is that we can then correlate different events that are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
data right here is that we can then correlate different events that are
happening across different
devices to help identify what's really happening on the network. For example do
we have a virus or
some malware or some other activity where it's being seen by multiple devices
we can then
collect all that and analyze it right here at the 40 Analyzer. So the types of
information logs
that we're going to have here are going to include things such as security
events things like malware
showing up or denial of service attacks or some other intrusion prevention
related activities
as well as system events for example configurations being changed on our
devices or who logged on who WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
devices or who logged on who
logged off as well as traffic logs all of that can be contained here at the 40
Analyzer. Now behind
the scenes the 40 Analyzer is going to use a structured query language database
and that's spelled
SQL and you can either spell it out like that SQL or it can say SQL and SQL
stands for structured
query language. So behind the scenes 40 Analyzer is taking all that data coming
in putting into
this database the SQL database and then when you and I connect to and log into
the 40 Analyzer it
can present that information in nice easy format for us including generating
reports but again WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
reports but again
behind the scenes it was using SQL and that type of database to keep track and
organize everything.
And there's many different types of SQL databases and on the 40 Analyzer the
one they use is right
here. So a person doesn't have to be an expert at SQL however for some of the
advanced reporting
capabilities if you're familiar with SQL and how it works it would be easier to
generate some of
those reports. So make the notice a little bit and let's talk about a few other
benefits and
functions of 40 Analyzer. So let me go ahead and clean this up a little bit and
let's chat about
some of the other fundamentals regarding 40 Analyzer. There's two different WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
some of the other fundamentals regarding 40 Analyzer. There's two different
operating modes that a
40 Analyzer can operate in and the default one is Analyzer and when the 40
Analyzer is in Analyzer
mode it's going to act just as we discussed where we have different devices
that have registered
with that 40 Analyzer. All that log and event information is being sent over
and then you and
I log into the 40 Analyzer to see all the details. So with Analyzer mode
devices are sending their
logs directly to the 40 Analyzer. Now the other mode is called collector mode
and think of a 40
Analyzer in collector mode is like being a middleman. So let's imagine we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Analyzer in collector mode is like being a middleman. So let's imagine we have
a 40 gate firewall here
that's forwarding its logs over to a collector really it's a 40 Analyzer that's
in collector mode
so I'll put FAZ here in collector mode and then the collector can then forward
those over to another
40 Analyzer that's operating in Analyzer mode and it's really simple to flip
the switch to tell the
40 Analyzer to be in collector mode or Analyzer mode and in small environments
we're going to just
skip the middleman and have our 40 gates and other 4-net devices send their
information directly to
the 40 Analyzer but in a bigger environment with wide area networking as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the 40 Analyzer but in a bigger environment with wide area networking as
possible we may want to
use multiple collectors who then forward it to our 40 Analyzers and if so that
would be the hierarchy
right here. 40 gates and other 4-net devices sending them to the collector and
then the collectors
forwarding them to the 40 Analyzer. Now one thing to be aware of regarding a 40
Analyzer in collector
mode is that we cannot at that device generate your ports and dig into the
details we can only do
that in a 40 Analyzer that set up in Analyzer mode. Now another aspect that we
want to be aware of
is a really cool feature inside of 4-net with 40 gates called a security fabric WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is a really cool feature inside of 4-net with 40 gates called a security fabric
. So let's imagine
that this firewall firewall 1 and firewall 2 and firewall 3 are all part of the
same security fabric.
Now in the security fabric let's also imagine that all three are sending their
login information
over to the 40 Analyzer. Now if this Windows computer right here or this PC
right here has
some event that happens and that traffic is for example going out to the public
internet that
traffic would go through firewall 2 and through firewall 1 and one would think WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
traffic would go through firewall 2 and through firewall 1 and one would think
well we're going
to have duplicate logs but fortunately on the 40 Analyzer if we have this 40
gate security fabric
here the 40 Analyzer realizes those are all part of the same security fabric
and it's going to help
reduce the duplicates regarding the logging. Also not every firewall has the
same rules some
firewalls may be focused on denial of service attacks other firewalls may be
focused on authentication
and network address translation. So the cool thing is because the 40 Analyzer
is also from
4-net it understands the security fabric it's going to help reduce duplicate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
4-net it understands the security fabric it's going to help reduce duplicate
log messages
if it's showing the same information and that way of the best of both worlds we
can get the logs
and security events regarding traffic that's going through and we don't have to
worry about a
bunch of duplicate logs regarding the exact same traffic flow or the exact same
events.
And while we're talking about fabric let's also chat about another concept
regarding fabric but
this time regarding 40 Analyzer and a 40 Analyzer fabric. So let me clean up
some of this right here
and let's talk about 40 Analyzer fabric. So let's imagine we have several 40
Analyzers in our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Analyzers in our
Enterprise we'll call this FAS 1 and what this is FAS 2 and over here FAS 3 and
let's imagine these
are all in Analyzer mode and just for grins let's also throw in FAS E4 which is
going to be in
collector mode. So we can have some devices that are affording their logs and
event information to FAS 4
as a collector who can then forward it to for example FAS 2 we're going to have
other devices
that are forwarding directly to FAS 3 and then FAS 2 and FAS 3 even though they
're an analyzer
mode can still forward their logs over to FAS 1. If we've set up the 40 Analy WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
mode can still forward their logs over to FAS 1. If we've set up the 40 Analy
zer fabric and here's
how it would work we would configure FAS 1 here as a supervisor as part of the
fabric which is kind
of equivalent to a root of the security fabric with 40 gates so in the 40 Analy
zer fabric we'd
have one the second as a supervisor and then these two could behave as members
which allows them to
forward logs information to the supervisor and then 40 Analyzer 4 which is not
an analyzer mode
because in collector mode it can't actually become part of the fabric it's just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
because in collector mode it can't actually become part of the fabric it's just
forwarding
information to the 40 Analyzer it was told to. So the 40 Analyzer fabric let me
go ahead and put
this in blue would be this part right here with the members forwarding to the
supervisor and then a
40 Analyzer operating in collector mode would not become part of that fabric
although it'd be
forwarding to one of the members in that fabric. So as far as what we've
covered so far in this
overview we have the 40 gate security fabric which the 40 Analyzer can sort out
and reduce
duplicate events we also have the 40 Analyzer fabric which if we have multiple WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
duplicate events we also have the 40 Analyzer fabric which if we have multiple
40 Analyzers
one would be supervisor and the other would be members in Analyzer mode so that
's an example of
the 40 Analyzer fabric. Another concept I'd like to share with you in this
overview is the concept of
administrative domains or ADOMS for short. Now in the 40 gates we have
something called V-DOMS
where we logically segment a firewall into multiple logical sub-firewalls if
you will and with 40
Analyzer we can set up 8 ADOMS administrative domains for the benefit of being
able to give
permissions to administrators to analyze and work with parts of the topology. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
permissions to administrators to analyze and work with parts of the topology.
So by setting up
administrative domains we can have 140 Analyzer for example that's getting logs
from all four of
our firewalls but perhaps we have one administrative domain for these three
firewalls at the head
corridor location and we have a separate administrative domain regarding the
branch firewall and that
way different administrators could have different access and permissions as
they interact with the
40 Analyzer depending on which administrative domain they've been given access
and privileges
to. And one other aspect that's really important when bringing up a new 40 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to. And one other aspect that's really important when bringing up a new 40
Analyzer is understanding
our options for connecting to it and the two major options are connecting via
the command line
interface or we could use the GUI and we think of the GUI like a browser using
a browser to
connect to the 40 Analyzer to do our work and at the 40 Analyzer we can specify
via permissions
exactly what is allowed regarding connecting to it. So for the CLI we can able
things like SSH
and for the GUI we can have HTTPS we also could allow HTTP although that's
insecure because it's
not encrypted and then for the CLI once we're at the GUI we also have an option WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
not encrypted and then for the CLI once we're at the GUI we also have an option
from the GUI from
the browser interface when we're working with the 40 Analyzer to go ahead and
click a button to get
a CLI to the 40 Analyzer should we need to issue command line interface
commands. So as we go through
this content together I'll give you examples of working with these options
including options
regarding how to connect to the 40 Analyzer.