Cato Management Application
Keep this at your keyboard during the lab sessions. It covers the log-in flow, where things live in the console, and the terms you will hear all day.
Logging in to your training tenant
Each lab team works in its own Cato demo tenant. The tenants start empty; by the end of the day they will have a site, a user, and traffic to look at. Your instructor will tell you which tenant your team owns.
Browse to cc.catonetworks.com and enter your assigned username.
Cato looks up which account owns that username and sends you to your CMA tenant.
Enter the same username again, then the password. You land on the tenant Home page.
cc.catonetworks.com is the shared front door for every Cato account. It uses your username only to find your tenant, then hands you to that tenant to authenticate. That second prompt is the tenant itself asking who you are. Same behavior in production, so you will see it again on your own account.
Tenant assignments
| Tenant | Username | Tenant | Username |
|---|---|---|---|
| 1 | catotd1@mtrx.com | 6 | catotd6@mtrx.com |
| 2 | catotd2@mtrx.com | 7 | catotd7@mtrx.com |
| 3 | catotd3@mtrx.com | 8 | catotd8@mtrx.com |
| 4 | catotd4@mtrx.com | 9 | catotd9@mtrx.com |
| 5 | catotd5@mtrx.com | 10 | catotd10@mtrx.com |
The seven places everything lives
The Cato Management Application (CMA) is organized around a left-hand navigation. Every lab today starts in one of these seven areas, so when a setting is hiding, ask which area it belongs to first.
Illustrative layout. Labels follow the CMA left-hand navigation and can shift slightly between Cato releases.
Where today’s labs live
| Lab | Start in |
|---|---|
| Getting Connected | Home, then Access |
| Sites & Sockets | Network |
| SD-WAN and Security Policies | Network (SD-WAN rules) and Security (firewall, IPS, DLP, CASB) |
| ZTNA | Access and Security |
| Reading the Data | Home (events, analytics, reports) |
The Cato Client
The Client is the first thing you install in the lab, and it is how every laptop and phone becomes part of the network. Away from the office it builds the tunnel to the nearest PoP. Behind a Socket it drops into Office Mode: no tunnel, but it keeps doing the three jobs below.
The X1600 Socket, from the back
The X1600 is the Socket model at each of your sites. It is a desktop form factor; rack-mount kits are included so it can go in the rack with the rest of the gear. Port capabilities are fixed by the hardware; the role each port plays (WAN or LAN) is assigned in the CMA under Network > Sites.
| Port | What it is | Worth knowing |
|---|---|---|
| Console | Serial console. Takes an RS-232 cable (RJ45) or any micro-USB cable. | Used by Cato Support to troubleshoot the Socket. |
| 1 (WAN) | 1 Gbps combo: copper RJ45 or SFP fiber. | One cable at a time. Auto-negotiate, full duplex. Intended for WAN traffic. |
| 2 | 1 Gbps combo: copper RJ45 or SFP fiber. | One cable at a time. Auto-negotiate, full duplex. |
| 3 – 4 | 10 Gbps fiber (SFP+). | 1 Gbps transceivers are not supported. No auto-negotiate. |
| 5 – 8 | 2.5 Gbps copper (RJ45). | Auto-negotiate supported. Port 8 is the MGMT port by default. |
| 12 VDC | Power supply input. |
Going Deeper
Network rules and QoS
- By default, Internet traffic leaves from Cato IPs at the PoP you are connected to.
- A network rule matches specific traffic, sets its priority, and says whether it should be routed a particular way.
- Priority is QoS: each rule carries a bandwidth profile, which is how voice and video win when a link is congested.
- Rules can egress traffic from a specific allocated Cato IP, which is what you use when a partner or SaaS app needs an IP allow list.
- Traffic no rule matches falls to the default rule.
| # | Name | Source | App / Service | Priority (QoS) | Route / Egress |
|---|---|---|---|---|---|
| 1 | Voice and video | Any | Zoom, Teams | P10 (highest) | Cato PoP |
| 2 | Bank portal allow list | Finance VLAN | bank.example.com | P40 | Egress via allocated IP |
| 3 | RDP Server at Colo | All sites | Remote Desktop | P50 (below data) | Off Cloud |
| – | Default rule | Any | Any | P255 | Cato PoP, from PoP IP |
Illustrative. Lower P number wins under contention. Rule 2 is the IP allow-list pattern; the default row is what everything else gets.
The three firewalls
| Firewall | Applies to | Enforced |
|---|---|---|
| Internet | All traffic with an Internet destination. | At the PoP |
| WAN | VLAN-to-VLAN, site-to-site, and remote user-to-site. | At the PoP |
| LAN | Traffic the Socket routes locally, without going to the PoP. | On the Socket |
By default all VLAN-to-VLAN traffic goes up to the PoP and through the WAN firewall. The LAN firewall is what changes that: a LAN rule lets the Socket switch that traffic locally instead.
TLS inspection
- Most traffic is encrypted. For the security modules to see inside it, TLS inspection has to be on. It is required for CASB and DLP; IPS and Anti-Malware catch far more with it.
- The PoP terminates the session, inspects, and re-encrypts with a certificate signed by the Cato CA. Endpoints must trust that CA, so the certificate is deployed to every device, traditionally by the Cato Client (or MDM).
The security modules
Going Deeper
Users first, then the rules for how they connect
Identity runs through the whole platform: once a user exists in Cato, their name can appear in network rules, firewall rules, and every event log. That is why every user belongs in Cato, not only the people who get a ZTNA (remote access) license. The six steps below are the order you build it in.
Cato events
- Every firewall rule with Track: Event on writes an event for each match, so VLAN-to-VLAN, WAN, and Internet traffic all show up. Security modules, connectivity, routing, posture, and admin changes log too.
- Events live in the Cato Data Lake and are viewed at Home > Events: filter by type, sub-type, user, site, or rule; query up to 31 days at a time; export up to 250,000 rows to CSV.
- Retention is 3 months by default. Data Lake units extend it to 6 or 12 months. Past retention the data is deleted, so anything you must keep longer needs a destination below.
- Cloud storage (AWS S3 or Azure Blob) gives you private long-term retention. Native connectors push to Microsoft Sentinel, Splunk, CrowdStrike NG-SIEM, or Datadog, or to any HTTP endpoint. The Events API (eventsFeed) lets a SIEM or MDR pull for itself.
- Noise control: create allow rules for known-safe chatter (DNS, Windows Update, Teams, Zoom) with tracking off. Firewall allow events are most of the volume, and most of the SIEM bill.
Configured under Resources > Event Integrations. Up to three integrations per account.