Hello. In this short demo, we’re going to discuss the capabilities of Cato’s firewall as a service. Now it’s worth noting that Cato’s Firewall is a native part of our SASE platform. And because of this, we can connect users, locations, data centers, cloud data centers, whatever they are.

We can connect them in with unlimited capacity. So no more sizing and deploying of physical firewalls in order to meet the need. We just have to connect into the Cato service, and they’re able to be secured using a comprehensive set of firewall policies. Now if we go over to security, we could take a look at what these policies look like.

You know, they’re very familiar to you. They’re applied top down approach first match wins, just like the firewalls that we’ve all used over the years.

First thing is there’s some, you know, general fields that are required. Right? We have to name our rule. We have to tell it what order to be in. In this case, he will call this test.

And then we move on. We can see source, right? So in order to really create that granular zero trust policy that you need for your organization, you can go here and we have a variety of context options here. Right? You know, not just user group, site type permissions, but also based on IP addresses, network interface, host, all of these kinds of things can be used to make the policies that make sense for you. In this case, let’s go ahead and we’ll select the whole site. And in this case, we’re going to call it the Houston branch location.

So device, we’re doing continuous device posture evaluation. And here is where you would apply that to be used in rules to evaluate things like, you know, antivirus status, disc encryption, and things like that.

App and category. Right? The service is completely application aware. So in this case, we could specify, you know, specific application.

Maybe we want to put Facebook or, maybe we want to just specify the entire social category. So I’ll go ahead and put social here and service slash port. Right? Because we are using a firewall architecture and we can inspect and enforce policies for all ports and protocols, you can build these right here into any policy that you like to get as granular as you need.

And this could be a port protocol like TCP eighty or it can be, you know, a service specifically. Right? Maybe you want to specify, only allowing RDP from certain locations or, IP addresses. You can easily do that with one of these rules.

But for now, we’ll go ahead and leave this as, any. And under actions, right, you have some things here you can allow, block, or prompt. But in this case, we’ll leave block and we’ll tell it to log in event when it happens. We could also set our rules to be defined during specific working hours.

Maybe we do want to allow Facebook after hours. But for now, we’ll just leave this to no time constraint.

I’ll go ahead and click apply, and we’ll see our rule appears at the bottom of the list like we planned. Now, I know for a lot of enterprises, they end up with, you know, hundreds of different policy rules and it becomes difficult to manage. And this was really designed to ease management at scale, not just in that, you know, most of our customers see an overall reduction of their total number of policies, but also in some nice, you know, features to help logically organize things. So maybe we want to go ahead and create a new section. Right? That’s, the first step in really having a good organization, and we’ll call this one custom rules.

And we have it apply after our default category of our default rules and you can see our custom rules, set is down here. So if we’ll go ahead and we’ll take our test rule, we could actually drag it into this group. And now we see, you know, our default and our custom are easily grouped together, just to make management easy.

Other thing is too is maybe we made a mistake and we didn’t really want to block social for the entire Houston branch. We have some, you know, individuals who work out of there and we want to exclude someone. Making exceptions is also easy to handle here. You don’t have to create a whole new policy. You can just go in this, and we can add an exception to this rule. So for this exception, we’ll just leave it new exception one. Source will make it an SDP user, and let’s say we pick Andy Bernard.

Device, we can leave that, we don’t have to worry about any of that. And then the rest of the other context we can leave as well. So we’re gonna go ahead and say, Apply.

And we’ve now created an exception for Andy Bernard to the test rule so that now he’ll be able to access social media.

Now the other side to this is Logging and Monitoring. Right? We need to have visibility into user activity in order to refine our security policies, as well as for things like audit and other purposes on an ongoing basis. Now all events that happen are logged to Cato’s data lake, and we can review those easily from the Cato management application.

Now, let’s expand our default outbound Internet rules, and we can see we have a default block for categories.

We can easily go here, and we can click view rule events, and we’ll see all events for the specific, category rule. Now if we expand one, we can see all of the context that we need. Right? We can see the user was demo user, at cato.marketing.

And it looks like they were trying to download Kali Linux, which is a known hacking tool. And because we’re blocking that category, it was blocked, but we also see a lot of other valuable information. Right? What OS the user is on, the name of their ISP, as well as their IP addresses and what site they were connected through.

So all this information is available and more, and thank you so much for watching this demo.

Hello and welcome to another video from Cato Networks. Every LAN requires full time protection.

Managing LAN security across multiple locations comes with two big challenges.

First, keeping up with hardware is a nightmare. Deploying, upgrading, and troubleshooting firewalls in multiple locations is costly and time consuming. And secondly, maintaining a centralized policy is complex. Keeping rules clean and consistent across multiple sites can be a constant struggle.

But what if you had LAN security that is simple, scalable, and hassle free? One that is an extension of your cloud access security. Cato Networks LAN next gen firewall, a native function of the Cato SASE cloud platform solves for this and more. The Cato Networks LAN next gen firewall is designed for simplicity.

Configuration is done on a site by site basis but it’s managed at the account levels. From the same single dashboard that manages internet and WAN firewalls, enabling LAN firewalls is just as simple. First, enable the feature.

Next, switch to the site firewall tab and enable LAN firewall for the site. No extra hardware, no complex setup. Next, let’s add the site we are deploying the LAN firewall rules to. For our case, it’ll be our AWS site. Then we will add the main container of the firewall rules. That will also establish the blacklist for the entire LAN network. Let’s switch to an FTP application and see it being blocked by the LAN firewall by default.

And you can see here that it times up pretty quickly because it is being blocked by the LAN firewall by default.

Back to the CMA.

And let’s add a single firewall rule that will allow the application to access the network for FTP transfer. We can switch back to the application now, and now we were able to connect and transfer files normally.

The Cato LAN Next Gen Firewall lets you secure your LAN easily from the same unified dashboard.

Next, let’s see how easy it is to leverage policies across multiple sites. This eliminates the need to manually configure each site or replicate settings across multiple boxes.

With Cato, simply add the site to the policy set, ensuring consistent security with just a few clicks. Here we have an additional site that needs to be added to the LAN firewall policy that we have here.

First, add the new site as a LAN firewall site, and then all we need to do is edit the policy in question to also include the new site. Save the changes, give that a moment or two to be pushed to the socket and done.

Cato extends the SASE footprint to now include the LAN, making it easier than ever to manage your global network from a single console with a single product. Be sure to check out our website for more information. Thanks for watching. We’ll see you next time.