Configure Tunnels with Silver Peak

The content provided here lists information about how to service chain traffic from Silver Peak EdgeConnect to Cisco Umbrella to enable threat protection and containment. Complete this task by setting up interoperable site-to-site IPsec tunnels between EdgeConnect and Umbrella. The following information includes instructions to configure a single internet breakout from the EdgeConnect to Umbrella.

Note: This document is based on Silver Peak EdgeConnect version 8.3.0.16. While we expect that IPsec tunnels will continue to work with devices as each vendor updates their device, we cannot guarantee connectivity for versions not explicitly listed as tested.

Table of Contents

• Configure Tunnels in Umbrella
  • Configure ADFS for SAML
• Configure Silver Peak EdgeConnect
  • Business Intent Overlay
  • Route Mapping
• Test the Configuration
• Other Resources

Configure Tunnels in Umbrella

Before the Silver Peak can be configured, you must create the correct tunnel FQDN and shared secret in Cisco Umbrella.

1. Navigate to Deployments > Core Identities > Network Tunnels and click Add.
2. Give the Tunnel a name and choose Other from the Device Type drop-down menu.

4. On the Set Tunnel ID and Passphrase page:
   a. Select FQDN
   b. Set the Tunnel ID.
   c. Set the Passphrase.

5. Copy the Tunnel ID and Passphrase once it has been confirmed and save it for the next section.

Configure ADFS for SAML

When configuring ADFS for SAML, the Umbrella SSL inspection can create issues with authentication. This is why it must be disabled for the traffic to the ADFS URL. The following topology describes the traffic flow:

• Topology: SAML user -> SP Edge -> Umbrella with SSL inspection enabled -> AD FS server

To solve an authentication issue, add the ADFS URL to the exclusion list in the Umbrella SSL inspection configuration.

Configure Silver Peak EdgeConnect

There a few ways to integrate Silver Peak EdgeConnect with Umbrella. The underlying transport to Umbrella remains the same, an IPsec tunnel, but the traffic steering can be done through:

• Business Intent Overlays (BIO)
• Route Mapping

BIO is the preferred method of traffic steering. When the Silver Peak EdgeConnect device has internet access, it will establish an IPsec tunnel and carry interesting traffic to Umbrella for threat protection and containment.

Business Intent Overlay

Configure the IPsec Tunnel

Configure an IPsec Tunnel from the Silver Peak EdgeConnect to the Umbrella headend.

1. In Silver Peak EdgeConnect, navigate to Configuration > System & Networking > Tunnels.
2. In the Passthrough tab select Add Tunnels, then select the General tab and add the following:

3. Select the IKE tab and add the following:

4. Select the IPsec tab and add the following:

5. Click Save.
6. From Configuration > System & Networking > Tunnels > Passthrough, review the status of the tunnel.

7. In Umbrella, navigate to Deployments > Core Identities > Network Tunnels and review the status of the tunnel from the Umbrella side.

Create the Business Intent Overlay (BIO)

1. Navigate to Configuration > Business Intent Overlay.
2. Select the Business Intent Overlay you want to add to the Umbrella breakout service.
3. Click the edit icon next to Match “Overlay ACL”, then click Add Rule.
4. Click Match Criteria, select Others, and then click Save.

5. Ensure traffic permission is set to Permit and click Apply.
6. Select the Breakout Traffic to Internet & Cloud Services tab and click the edit icon.

7. Click the edit icon next to Available Policies, choose Umbrella and then click Add.

8. Click Save
   The Umbrella policy appears in the list of Available Policies.

9. Optionally, select and drag the Umbrella Policy from Available Policies to the top of the Preferred Policy Order and then click OK.

Route Mapping

Configure the IPsec Tunnel

Configure an IPsec Tunnel from the Silver Peak EdgeConnect to the Umbrella headend.

1. In Silver Peak EdgeConnect, navigate to Configuration > System & Networking > Tunnels.
2. In the Passthrough tab select Add Tunnels, select the General tab, and add the following:

2. In the IPsec tab, add the following:

3. Click Save.
4. Navigate to Configuration > System & Networking > Tunnels > Passthrough and review the status of the tunnel.

5. In Umbrella, navigate go to Deployments > Core Identities > Network Tunnels and review the status of the tunnel from the Umbrella side.

Create an Access List for Interesting Traffic

1. From the EdgeConnect dashboard, navigate to Configuration > Policies > Access Lists and click Add.

2. Click Add Rule, then clickMatch Criteria and select Other.

3. Click Save.
4. Confirm that traffic permission is set to Permit and click Apply.

Create a Route Map

1. In EdgeConnect, navigate to Configuration > Policies > Route Policies and click Add Map.

2. Click Add Rule and then click Match Criteria.
3. Select ACL and from the drop-down menu choose the ACL created in the previous step.

5. Click Set Actions and add the following:

• Destination Type—Passthrough Tunnel
• Destination—tunnel-to-umbrella
• Fallback—pass-through

6. Click Save and then click Apply.

Test the Configuration

Once the Silver Peak EdgeConnect deployment is complete, log in into any machine connected to the LAN subnet and run the ‘curl http://ifconfig.co’ command or through a browser access ‘http://ifconfig.co’. If everything is working as expected and an IP address in the 146.112.x.x range is returned.

Other Resources

Umbrella Cloud Firewall

• Manage the Firewall Policy
• Supported IPsec Parameters

---

Configure Tunnels with Sophos XG IPsec < Configure Tunnels with Silver Peak > Configure Tunnels with Fortinet IPsec