Cisco Live Protect Configuration Guide
Overview and Purpose
The purpose of Live Protect is to mitigate certain vulnerabilities without requiring network upgrades and reboots. Isovalent uses eBPF (extended Berkeley Packet Filter), a powerful kernel technology that allows safe, efficient execution of user-defined programs within the Linux kernel for tasks like networking, observability, and security without modifying kernel code. Isovalent's Tetragon agent uses eBPF to dynamically monitor and enforce security policies in real time by tracing kernel-level events like process execution, file access, and network activity without requiring kernel changes or restarts. IOS-XE uses SE Linux (Security-Enhanced Linux) to safeguard the security of network devices. Tetragon/eBPF gives Cisco the ability to dynamically remediate security threats using compensating controls. A compensating control is a security measure that is implemented as an alternative to, and much more quickly than, directly resolving the security vulnerability. In the context of networking devices, a compensating control would be a modification to the operation of the device to block a vulnerability or exploit before an operating system patch is available, or when a customer is unable to update their Operating System. The Live Protect shields can be managed manually using network device CLI but this beta concentrates on the use of Catalyst Center to manage the shields, map known vulnerabilities to shields and devices, provision the appropriate shields to the network, and display hit count statistics.
A Live Protect shield supports two operating modes:
- Monitoring: The shield records matching activity but does not block it.
- Enforcing: The shield blocks matching activity and records an enforcing hit.
The Meraki dashboard allows an administrator to complete the following tasks:
- Review vulnerabilities that affect managed devices.
- Identify an available Live Protect shield.
- Deploy the shield in monitoring mode.
- Review deployment status and hit counters.
- Promote the shield to enforcing mode.
- Return the shield to monitoring mode or deactivate it.
Prerequisites and Limitations
Before configuring Live Protect, ensure the following requirements are met:
Licensing Requirements
| Device Family | Licensing Requirements |
|---|---|
| Cisco Smart Switches | Live Protect is included in the existing Essentials entitlement across Cisco Networking Subscription and Meraki Classic co-term licensing. No additional feature-specific license is required. |
| Cisco Campus Gateway | Cisco Campus Gateway does not require a dedicated license and is included with Cisco Wireless access point licensing. Live Protect is included in the Essentials entitlement for Cisco Networking Subscription licensing and Meraki Subscription licensing as well as the Enterprise entitlement for or Meraki Classic co-term licensing. No additional feature-specific license is required. |
Hardware Requirements
Live Protect is available on the following models:
| Device Family | Models |
|---|---|
| Cisco Smart Switches |
|
| Cisco Campus Gateway |
|
Firmware Requirements
Live Protect is available on devices with the following firmware versions:
- Cloud Native IOS XE Switches: IOS XE 26.2.1
- Cisco Campus Gateway: MCG 33.1
Configuration Steps
Navigate to Live Protect
- Navigate to the Meraki Network that contains the devices that require the shields.
- Go to Security > Security Advisories
Security Advisories Tab
The Advisories tab displays the known Common Vulnerabilities and Exposures (CVE) that are affecting the devices in the Meraki Organization.
Each CVE will give the following details:
- Advisory ID: The Cisco Security Advisory ID.
- Clicking on the ID will open the respective Cisco Security Advisories page that gives more details on the CVE for the Cisco products.
- Advisory Title: A short description of the vulnerability.
- CVSS score: The Common Vulnerabilities Scoring System (CVSS) score
- Impact
- CVE: The CVE identifier for the security advisory.
- Devices: The number of devices in the Meraki Organization that are affected by the CVE.
- Clicking the number of devices will display which devices are affected
- The list of Active devices can be suppressed from alerting users.
- Known since: The date the CVE was known/discovered.
- Last update: The date that the advisory information was last updated.
Devices Tab
The Devices tab displays the devices in the Meraki Organization that are affected by the CVEs.
For tracking purposes, dashboard will show the following information for each device:
- Device Name
- Serial Number: This is the Cloud ID used to claim the device in dashboard.
- Network: This is the Meraki Network the device is added to.
- IP Address: This is the public IP of the device.
- Advisories: The number of CVEs that are affecting the device.
- Clicking on the number will show the exact CVEs
- Software Version
- Model
Applying Live Protect Shields
- Navigate to the Live Protect Shields tab.
- On the Live Protect Shields tab, there is a listing of available shields that are relevant to the devices in the Meraki Organization.
- To deploy the relevant shield, click on the ••• button and select Deploy Available.
Note: Select Promote to Enforcing to deploy the shield in Enforcing mode. This applies whether the shield has not yet been deployed or is currently in Monitoring mode.
- Choose whether to deploy the shield in Monitoring or Enforcing mode and select the devices to deploy the shields to.
Live Protect deployment dialog for selecting Monitoring or Enforcing mode and target devices. - Click Deploy Now.
Troubleshooting
Use the switch’s Cloud CLI available through Meraki Dashboard for troubleshooting via CLI.
Check Live Protect shield state and counters
show platform software live-protect shield
Expected output fields: Aggregate Live Protect Hit Counters; LP Shield ID; Mode; Enforcing Hits; Monitoring Hits; Total Hits.
Aggregate Live Protect Hit Counters
LP Shield ID Mode Enforcing Hits Monitoring Hits Total Hits
cve-1900-99999-v01 Monitoring 0 10 10
How to use the result: Confirm that the Mode matches the Dashboard state. Compare Monitoring Hits and Enforcing Hits with the Dashboard event counters. The shield ID in this example is demonstration data; use the current ID in your organization.
Verify firmware and shield installation
show install active
Expected output fields: Type, State, Filename/Version
[ Switch 1 ] Active Package(s) Information:
State (St): I - Inactive, U - Activated & Uncommitted,
C - Activated & Committed, D - Deactivated & Uncommitted
--------------------------------------------------------------------------------
Type St Filename/Version
--------------------------------------------------------------------------------
IMG C 26.02.01.0.2
LPS C flash:cisco9k_iosxe.26.02.01lpseft3.CVE-1900-99999.lps.SPA.bin
How to use the result: Confirm that the firmware is 26.2.1 and the shield has been installed and is activated.
Common command results
Mode is Monitoring
Expected after the first deployment. Review monitoring hit counts before promotion.
Mode is Enforcing
Confirm the Dashboard shows the shield under Enforcing and correlate Enforcing Hits with events.
Counters are unchanged
Refresh Dashboard, allow time for propagation (up to 15 minutes to display on Dashboard), confirm the correct shield ID, and rerun the show command.
Troubleshooting by symptom
Shield does not appear
Likely cause: Unsupported model or firmware. What to check: Confirm Catalyst 9350/9550/9610 and firmware 26.2.1 or later; refresh after updating.
No candidate devices
Likely cause: Device is offline, ineligible, or already assigned a state. What to check: Check device status, model, firmware, and the Available/Monitoring/Enforcing filters.
Deployment remains Deploying
Likely cause: Propagation still in progress or device connectivity issue. What to check: Wait several minutes, refresh, and confirm the switch is online and connected to Dashboard.
Monitoring hits do not match
Likely cause: Different shield, time window, or stale view. What to check: Confirm LP Shield ID, refresh Dashboard, and rerun show platform software live-protect shield.
Unexpected enforcing hits
Likely cause: Traffic matched the active shield. What to check: Review event details, affected device/interface, and change records; deactivate only under approved change control.