Contained in the Cellular World Congress 2026 SOC: Detecting Shadow Site visitors with Firepower 6100

[ad_1] Deploying a brand new firewall platform in a reside, high-density setting like Cellular World Congress, with over 100,000 members, is a uncommon alternative to validate its capabilities in opposition to really unpredictable site visitors. This yr, our timing couldn’t have been higher. The launch of the Firepower 6100 {hardware} and the ten.0 software program launch aligned completely with MWC 2026, giving us a hands-on alternative to place the newest Cisco Safe Firewall capabilities to the check on the reside congress wi-fi community. Among the many new safety options, the one I used to be most wanting to discover was Shadow Site visitors detection. After per week of monitoring the reside community with the Firepower 6100 equipment, I wasn’t dissatisfied.

What Is Shadow Site visitors?

When you handle a company community, you’ve most likely spent a lot of time constructing firewall insurance policies, configuring entry controls, and tuning your safety guidelines – all to make sure your customers entry web assets in accordance along with your group’s coverage, site visitors is inspected, and that unauthorized or dangerous content material stays blocked.

Even with a well-designed firewall coverage and totally educated workforce, you can't totally forestall community site visitors particularly engineered to stay invisible, which we confer with as shadow site visitors. These are connections trying to bypass your safety controls, cover their true vacation spot, or evade inspection completely.

Shadow site visitors is available in many shapes. Generally it comes from a person who simply needs to stay nameless and downloads a free anonymizer app with out pondering twice. Some customers intentionally set up VPN shoppers to bypass safety coverage and entry prohibited websites and purposes whereas within the workplace. Different occasions, it could possibly be one thing much more regarding – malware quietly reaching out to a command-and-control server, utilizing intelligent tips to keep away from detection. In all circumstances, this results in a safety coverage violation and exposes your setting to pointless threat.

Most conventional firewalls depend on fundamental software detection mechanisms that catch some evasive exercise, however you’re left with manually digging via huge volumes of logs regularly, trying to find one thing suspicious. When you don’t know precisely what to search for, or a brand new evasion approach has emerged because you final appeared, you could discover completely nothing – even when one thing harmful is already taking place.

Cisco Safe Firewall 10.0 addresses this hole with Shadow Site visitors detection. Fairly than leaving you with that handbook effort, the system actively screens connections and flags those who present indicators of evasion. The detection engine combines three safety elements working tightly collectively:

Software ID (AppID)

Encrypted Visibility Engine (EVE)

TLS/QUIC decryption

Collectively, they detect greater than 80 evasive instruments and methods, together with area fronting and faux TLS connection. A devoted dashboard brings all of it collectively in a single place, with a brand new Shadow Site visitors Kind column in your connection occasions surfacing suspicious exercise proper the place you want it. When suspicious exercise is detected, connection occasions are explicitly tagged with the respective shadow site visitors flags. From there, you'll be able to monitor down the endpoint, have a dialog with the person, and work out what’s truly occurring.

Observing Shadow Site visitors at scale on the reside congress wi-fi community offered helpful perception. On common, we noticed round 150,000 evasive VPN connections, 2.5 million multihop proxy connections, almost 10 million encrypted DNS requests, and roughly 125,000 pretend TLS connections per day. The findings under break down the shadow site visitors by class.

Evasive VPNs

Evasive software program stays a standard and troublesome drawback to resolve for many organizations. A person downloads a free VPN app – one thing like XVPN, ExpressVPN, or any of dozens of evasive purposes obtainable on-line – and connects via it, successfully masking every little thing they do out of your firewall. Relying on the software program, the connection might solely cover the vacation spot, or it could use particular methods to mix into odd internet site visitors completely. Methods like site visitors masking and protocol obfuscation imply that even a classy firewall might not discover something uncommon.

At MWC, we noticed dozens of various evasive VPN shoppers within the wild. The Shadow Site visitors dashboard put Tailscale VPN, ExpressVPN, and NordVPN on the prime of the checklist. Shadow Site visitors detection conveniently labels the suspicious connections, making filtering within the Unified Occasions Viewer easy and exact.

The screenshot above from the Unified Occasions Viewer illustrates a couple of examples of Evasive VPN connections found utilizing completely different detection strategies, displaying AppID and EVE working in parallel, masking one another’s blind spots:

NordVPN utilizing TCP port 89 — traditionally related to the Telnet Gateway at MIT — detected by AppID

ExpressVPN utilizing a typical HTTPS port with a randomized SNI/URL that AppID didn't establish, however that EVE fingerprinted with 84% confidence

Tailscale VPN connecting over QUIC on non-standard port 3478, detected by EVE with 99% confidence

A second NordVPN connection over TCP port 8885, detected by AppID

Out of just about 150,000 evasive VPN connections noticed every day at MWC, these 4 examples are a small pattern, however they clearly reveal the advantage of AppID and EVE working collectively. Every one slipped previous what both technique alone would have missed. These examples additionally showcases how inventive the stealth methods could also be – ranging from using non-standard ports and randomized URLs to rising cryptographic protocols not but broadly supported on most firewalls right this moment.

Multihop Proxies

Multihop proxies do precisely what the title suggests — as an alternative of routing site visitors via a single middleman, they bounce it via a number of servers earlier than it reaches its ultimate vacation spot. Tor is the basic instance. Every hop provides one other layer of obfuscation, and by the point site visitors reaches its vacation spot, tracing it again to the unique supply is extraordinarily troublesome. From the firewall’s perspective, it simply sees a connection to some relay node with no visibility into the place it’s in the end going.

This method is primarily about anonymization — hiding the person’s true id and vacation spot. Whether or not that’s a privacy-conscious particular person or somebody purposely doing one thing malicious, the consequence for you as an administrator is identical – you lose visibility and management.

Wanting on the Shadow Site visitors knowledge from MWC, the overwhelming majority of the multihop proxy connections have been generated by Apple iCloud Non-public Relay infrastructure. It’s price pausing on that for a second – iCloud Non-public Relay isn’t malicious. It’s a legit and broadly used Apple privateness characteristic. However from a community coverage standpoint, it nonetheless creates a visibility hole, and many organizations might determine to disable or block it on company networks. Discovering the dimensions of iCloud Non-public Relay utilization on your community via the Firewall Administration Heart dashboard provides you the proof that you must make that coverage choice confidently.

We additionally noticed a smaller portion of CDN77 and Cloudflare connections, and a handful of HTTP CONNECT tunnel classes. These latter ones in specific are the kind you’d need to take a look at extra intently should you noticed them in your individual setting to make sure there is no such thing as a malicious exercise concerned.

Encrypted DNS

DNS won't sound like essentially the most thrilling safety subject, however encrypted DNS is genuinely one of many greater complications for community directors proper now. Usually, when a consumer resolves a website title, that question goes via the endpoint’s OS DNS stack, permitting enforcement of company DNS controls, filtering, and logging. Encrypted DNS adjustments that completely.

With protocols like DNS-over-HTTPS (DoH), a browser can utterly bypass the working system’s DNS stack and ship its queries on to a public resolver — Cloudflare or Google, for instance — over an encrypted tunnel. Your firewall sees an encrypted HTTPS connection to a recognized public IP and has no concept that DNS decision is going on inside it. Your DNS-based safety controls change into successfully ineffective.

Encrypted DNS is not only a standalone concern as it is now additionally a elementary constructing block for one thing greater. Looking forward to Encrypted Shopper Whats up turning into an official customary below RFC 9849, encrypted DNS is a key bootstrapping mechanism for ECH — distributing encryption keys and server particulars to endpoints. If you wish to go deeper on what ECH means for community safety, have a take a look at the article “Encrypted Shopper Whats up (ECH) Protection Methods — How Cisco Safe Firewall Tackles ECH” on the Cisco Safe Firewall Necessities Hub.

Setting the upcoming ECH transition apart, MWC knowledge exhibits widespread use of encrypted DNS. We noticed connections not solely to the well-known resolvers like OpenDNS, Cisco Umbrella, Cloudflare and Google, but in addition much less acquainted providers from distant geographic areas. One which stood out was doh.pub, a Chinese language public resolver which whereas being a legit service, might elevate considerations if noticed in a protected company infrastructure.

Mapping this again to your individual group’s community: it's strongly beneficial to dam unsanctioned encrypted DNS resolvers. Shadow Site visitors detection is an especially great tool for gaining visibility into encrypted DNS utilization and confirming whether or not your controls are really holding.

Area Fronting

One class we couldn't validate at MWC was area fronting, as a result of the Firepower 6100 models at MWC weren't deployed inline and TLS/QUIC decryption was not enabled in that setting. However, I wished to verify this functionality will get your consideration, as a result of deployed accurately in your group’s firewall coverage, it closes a spot that many groups don’t even know they've.

Area fronting is technically one of many cleverest methods within the shadow site visitors toolkit. A consumer initiates a TLS connection to a very legit, broadly trusted server — a significant CDN or cloud supplier, as an example. The TLS handshake seems to be clear, the SNI area factors to a benign area, and your firewall sees nothing suspicious and lets it via. However inside that encrypted tunnel, the HTTP Host header factors to a completely completely different server — doubtlessly malicious — hosted on the identical or, in some circumstances, a distinct supplier. The fronting server quietly forwards the request to the actual goal, and your firewall by no means sees any of it.

This technique exploits CDN request routing habits, and for a interval it was comparatively simple to execute in opposition to virtually any main CDN. Most suppliers have closed these gaps now, but it surely nonetheless surfaces within the wild. Detection requires TLS/QUIC decryption to be enabled — you want to have the ability to look contained in the tunnel and evaluate the TLS endpoint (SNI/certificates) with the precise HTTP hostname within the request. When these don’t match the firewall units the area fronting flag within the connection log. Shadow Site visitors detection helps you uncover these occasions at scale. As an alternative of manually looking via 1000's of decrypted connections, the characteristic compares TLS and QUIC handshake metadata with HTTP requests despatched contained in the tunnel and assigns a “Area Fronting” flag to connections the place this mismatch is detected.

Faux TLS

Faux TLS is essentially the most technically fascinating detection on this lineup — and the MWC knowledge gave us an awesome real-world instance to point out why.

The idea is to craft a TLS connection that appears legit on the floor however accommodates uncommon or non-standard attributes – not often used cipher suites, surprising extensions, or handshake traits designed to set off exception logic on a safety machine. A pretend TLS connection sometimes spoofs the SNI area, pretending to hook up with a benign, trusted area, whereas the precise vacation spot server is one thing else completely. The purpose is to confuse safety units into ignoring or misclassifying the session.

At MWC, Shadow Site visitors detection flagged a connection with www.google.com within the TLS Shopper Whats up SNI that appeared legit at first. What made this connection stand out was the EVE fingerprinting, which indicated that it originated from a Telegram binary.

A more in-depth look in Wireshark revealed one thing instantly odd within the TLS Shopper Whats up: extension kind 65026, a price sitting firmly in IANA’s unassigned pool – extremely uncommon in a legit handshake. Once we checked the vacation spot IP deal with, it turned out to be a BGP subnet related to Telegram — nothing to do with Google in any respect. The applying was presenting a trusted, recognizable area title to idiot the firewall, whereas truly connecting to infrastructure it had no affiliation with.

Faux TLS detection is powered by EVE. By trying on the full image — course of title, TLS extensions, cipher suites, vacation spot IP — EVE cross-references indicators that individually might sound unremarkable however collectively paint a transparent image of evasion. Detection requires EVE to be enabled, however as soon as it's, these connections are flagged clearly in your connection occasions and surfaced within the Shadow Site visitors dashboard.

What Ought to You Do About It?

Shadow site visitors isn’t a distinct segment drawback reserved for high-security environments. It’s virtually definitely already current in your community, and most organizations merely don’t understand it. The mix of AppID, EVE, and TLS/QUIC decryption in Cisco Safe Firewall 10.0 gives a sensible and consolidated method to lastly see what’s been hiding in plain sight — and take motion on it.

With Shadow Site visitors detection, you broaden visibility into inspection gaps that the majority organizations don’t even notice they've. You'll be able to shortly establish endpoints or customers trying evasion, and you've got a robust place to begin for remediation. Pair that with person training round acceptable use insurance policies, and you’ve tangibly diminished the variety of entry factors for something attempting to sneak previous your defenses.

My advice is straightforward: allow Shadow Site visitors detection when working Cisco Safe Firewall 10.0, and see for your self how a lot site visitors is attempting to slide below your radar. From there, you can begin tightening your coverage, figuring out machines with evasive software program put in, and getting forward of the new strategies that customers, software program and risk actors will proceed to introduce.

Count on new evasion methods to look and evolve repeatedly. Shadow Site visitors will most likely at all times be a shifting goal and unattainable to completely eradicate. The builders behind these evasive instruments are sensible, they replace the code continually, and they’re at all times in search of new methods to remain forward. The purpose isn’t essentially to dam every little thing — it’s to know when one thing suspicious is going on and who is chargeable for it in your community.

To study extra about the newest safety options within the Cisco Safe Firewall 10.0 toolkit, go to Firewall Necessities Hub and watch the newest BRKSEC-3320 deep-dive session masking TLS/QUIC decryption, Shadow Site visitors and EVE in Cisco Dwell! On-Demand Library.