As recently announced, Cisco AnyConnect 4.2 extends visibility to the endpoint with the Network Visibility Module (NVM).  Users are one of the most vulnerable parts of any security strategy, with 78% of organizations saying in a recent survey that a malicious or negligent employee had been the cause of a breach.  However, until now, IT Administrators had been blind to user behavior on their devices.  NVM allows you to monitor and analyze this rich data to help you defend against potential security threats like data exfiltration and shadow IT, as well as address network operations challenges like application capacity planning and troubleshooting.

AnyConnect NVM supports the Cisco Network Visibility Flow protocol ornvzFlowfor short
(pronounced:en-vizzy-flow).  The protocol is designed to provide greater network visibility of endpoints in a lightweight manner by extending standard IPFIX with a small set of high-value endpoint context data.  Leading IPFIX vendors have begun implementing the new protocol to provide customers with an unprecedented level of visibility.

Here are some examples of the types of questions an IT Administrator would like to answer:

1. Where are the enterprise users accessing SaaS services from and what services are they accessing from a given location?
2. Are they using a company asset or a BYOD device when accessing these services?
3. Did they use an approved application or a potentially vulnerable version of an application?

The nvzFlow protocol allows for an IT administrator to answer these questions as follows:

Mary visited Salesforce.com from an unmanaged Windows 8.1 laptop using a company approved browser, Firefox version 42, while she was connected on her local Starbucks' Wi-Fi network.

From the above statement, the 5 key visibility categories are conveyed by the protocol as:

• User(Mary)
• Device(unmanaged Windows 8.1 laptop)
• Application(approved browser, Firefox version 42)
• Location(local Starbucks)
• Destination(Salesforce.com)

Here are some basic reports that you can build using the richnvzFlowdata set with any IPFIX reporting tool that can support the protocol:

What are the top 15 network applications by downloaded data over the last 24 hours at our enterprise?

What are the top flows by destination domain over UDP in the last 24 hours?

How many different versions of Cisco Jabber are users running in the enterprise?
Also, what destination domains is Cisco Jabber connecting to so I can set appropriate firewall, proxy and split tunneling policies?

The enterprise IT team learned of a recent incident with Fred on his BYOD device.  The InfoSec team will need to determine where Fred was when he accessed the network over VPN and what destination domains Fred was connecting to.

As you can see, the protocol offers an impressive set of network visibility context. We have been running some advanced machine learning algorithms in the Office of the Security CTO on a few months of live nvzFlow data from several hundred AnyConnect NVM endpoints.  We will share some of our findings in a follow-on blog.

Meanwhile, for those of you who are interested in the details of the protocol, please read on.

nvzFlow IPFIX protocol:

This new protocol was developed by the Office of the Security CTO at Cisco, and is planned to be moved to a standards track in the near future.

In order to be included in the protocol, eachdata elementmust meet the following requirements:

1. Convey information directly related to the five key visibility categories shown above.
2. Be clear, obvious and of high value to an IT administrator.
3. Is useful to analytics, while not requiring the use of analytics (raw-data value).
4. Easily obtainable information across a wide variety of OS and device types.
5. Lightweight and portable (no network, battery or CPU impact; no DPI required; etc.)

There are 3 templates as part of the nvzFlow Protocol:

• Endpoint -Fields that are associated with an Endpoint Device, such asOS Name.
• Interface -Fields associated with the network interface, such asAdapter Name.
• Flow -Fields associated with the flow itself, such asL4 Bytes Out.

The Endpoint and Flow templates are present in the initial release of the AnyConnect Network Visibility Module.  Subsequent releases will support the remaining elements of the protocol.

Note that some fields will be present in multiple templates for cross correlation purposes.
These are mandatory fields, while all others can be either anonymized ("-") or not sent at all.
Finally, all string types are encoded in UTF-8 format.