Firewall-as-a-Service Demo

Hello. In this short demo, we’re going to discuss the capabilities of Cato’s firewall as a service. Now it’s worth noting that Cato’s Firewall is a native part of our SASE platform. And because of this, we can connect users, locations, data centers, cloud data centers, whatever they are.

We can connect them in with unlimited capacity. So no more sizing and deploying of physical firewalls in order to meet the need. We just have to connect into the Cato service, and they’re able to be secured using a comprehensive set of firewall policies. Now if we go over to security, we could take a look at what these policies look like.

You know, they’re very familiar to you. They’re applied top down approach first match wins, just like the firewalls that we’ve all used over the years.

First thing is there’s some, you know, general fields that are required. Right? We have to name our rule. We have to tell it what order to be in. In this case, he will call this test.

And then we move on. We can see source, right? So in order to really create that granular zero trust policy that you need for your organization, you can go here and we have a variety of context options here. Right? You know, not just user group, site type permissions, but also based on IP addresses, network interface, host, all of these kinds of things can be used to make the policies that make sense for you. In this case, let’s go ahead and we’ll select the whole site. And in this case, we’re going to call it the Houston branch location.

So device, we’re doing continuous device posture evaluation. And here is where you would apply that to be used in rules to evaluate things like, you know, antivirus status, disc encryption, and things like that.

App and category. Right? The service is completely application aware. So in this case, we could specify, you know, specific application.

Maybe we want to put Facebook or, maybe we want to just specify the entire social category. So I’ll go ahead and put social here and service slash port. Right? Because we are using a firewall architecture and we can inspect and enforce policies for all ports and protocols, you can build these right here into any policy that you like to get as granular as you need.

And this could be a port protocol like TCP eighty or it can be, you know, a service specifically. Right? Maybe you want to specify, only allowing RDP from certain locations or, IP addresses. You can easily do that with one of these rules.

But for now, we’ll go ahead and leave this as, any. And under actions, right, you have some things here you can allow, block, or prompt. But in this case, we’ll leave block and we’ll tell it to log in event when it happens. We could also set our rules to be defined during specific working hours.

Maybe we do want to allow Facebook after hours. But for now, we’ll just leave this to no time constraint.

I’ll go ahead and click apply, and we’ll see our rule appears at the bottom of the list like we planned. Now, I know for a lot of enterprises, they end up with, you know, hundreds of different policy rules and it becomes difficult to manage. And this was really designed to ease management at scale, not just in that, you know, most of our customers see an overall reduction of their total number of policies, but also in some nice, you know, features to help logically organize things. So maybe we want to go ahead and create a new section. Right? That’s, the first step in really having a good organization, and we’ll call this one custom rules.

And we have it apply after our default category of our default rules and you can see our custom rules, set is down here. So if we’ll go ahead and we’ll take our test rule, we could actually drag it into this group. And now we see, you know, our default and our custom are easily grouped together, just to make management easy.

Other thing is too is maybe we made a mistake and we didn’t really want to block social for the entire Houston branch. We have some, you know, individuals who work out of there and we want to exclude someone. Making exceptions is also easy to handle here. You don’t have to create a whole new policy. You can just go in this, and we can add an exception to this rule. So for this exception, we’ll just leave it new exception one. Source will make it an SDP user, and let’s say we pick Andy Bernard.

Device, we can leave that, we don’t have to worry about any of that. And then the rest of the other context we can leave as well. So we’re gonna go ahead and say, Apply.

And we’ve now created an exception for Andy Bernard to the test rule so that now he’ll be able to access social media.

Now the other side to this is Logging and Monitoring. Right? We need to have visibility into user activity in order to refine our security policies, as well as for things like audit and other purposes on an ongoing basis. Now all events that happen are logged to Cato’s data lake, and we can review those easily from the Cato management application.

Now, let’s expand our default outbound Internet rules, and we can see we have a default block for categories.

We can easily go here, and we can click view rule events, and we’ll see all events for the specific, category rule. Now if we expand one, we can see all of the context that we need. Right? We can see the user was demo user, at cato.marketing.

And it looks like they were trying to download Kali Linux, which is a known hacking tool. And because we’re blocking that category, it was blocked, but we also see a lot of other valuable information. Right? What OS the user is on, the name of their ISP, as well as their IP addresses and what site they were connected through.

So all this information is available and more, and thank you so much for watching this demo.