WEBVTT

1
00:00.000 --> 00:00.770 align:middle line:84%


2
00:00.770 --> 00:02.270 align:middle line:90%
If we want to use
the web security

3
00:02.270 --> 00:04.760 align:middle line:90%
appliance in conjunction
with Active Directory,

4
00:04.760 --> 00:07.400 align:middle line:90%
like matching based on
usernames or group membership

5
00:07.400 --> 00:09.140 align:middle line:90%
from Active Directory,
we have to set up

6
00:09.140 --> 00:11.690 align:middle line:90%
that link between the web
security appliance and Active

7
00:11.690 --> 00:13.273 align:middle line:90%
Directory, and that's
what we're going

8
00:13.273 --> 00:14.670 align:middle line:84%
to do together in this video.

9
00:14.670 --> 00:16.550 align:middle line:84%
So here is the play by play.

10
00:16.550 --> 00:24.620 align:middle line:90%
I've got the WSA at .155 on
this 192.168.1.0 network,

11
00:24.620 --> 00:28.010 align:middle line:90%
and I've got the Active
Directory server at .100.

12
00:28.010 --> 00:30.780 align:middle line:90%
So the basic installation of the
WSA was already put in place.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.010 --> 00:30.780 align:middle line:90%
So the basic installation of the
WSA was already put in place.

13
00:30.780 --> 00:32.180 align:middle line:84%
I'm just using one interface.

14
00:32.180 --> 00:34.940 align:middle line:90%
You can actually use multiple,
but I use just one interface

15
00:34.940 --> 00:37.730 align:middle line:90%
for both management and
also for the proxy services,

16
00:37.730 --> 00:39.770 align:middle line:84%
and it is at .155.

17
00:39.770 --> 00:41.660 align:middle line:84%
So here I am at the logon.

18
00:41.660 --> 00:44.300 align:middle line:90%
I logged on to the IP address
of the web security appliance

19
00:44.300 --> 00:49.770 align:middle line:90%
with the port 8443, which was
agreed to in the initial setup.

20
00:49.770 --> 00:51.230 align:middle line:84%
So I'll login in as admin.

21
00:51.230 --> 00:54.110 align:middle line:84%
I'll put in the password I set.

22
00:54.110 --> 00:55.693 align:middle line:90%
The default password
is ironport,

23
00:55.693 --> 00:57.110 align:middle line:90%
put the setup
installation has you

24
00:57.110 --> 00:58.500 align:middle line:84%
change that as you go along.

25
00:58.500 --> 01:01.097 align:middle line:90%
So it's dropping us by default
under the reporting tab
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

25
00:58.500 --> 01:01.097 align:middle line:90%
So it's dropping us by default
under the reporting tab

26
01:01.097 --> 01:03.680 align:middle line:90%
to my dashboard, and if we want
to integrate Active Directory,

27
01:03.680 --> 01:06.710 align:middle line:90%
we simply go to network
right over here and then

28
01:06.710 --> 01:10.220 align:middle line:90%
other network, we would select
authentication right here.

29
01:10.220 --> 01:13.230 align:middle line:90%
And to add our Active Directory,
we'd add it as a realm,

30
01:13.230 --> 01:17.240 align:middle line:90%
so we click on add realm here
under authentication realms.

31
01:17.240 --> 01:19.650 align:middle line:90%
And it's going to give the
realm name of AD server.

32
01:19.650 --> 01:21.650 align:middle line:90%
We can select the type
of authentication schemes

33
01:21.650 --> 01:23.983 align:middle line:90%
we'd like to use, so this
option here, Active Directory,

34
01:23.983 --> 01:27.230 align:middle line:90%
allows Kerberos, NTLSM, SSP,
or basic authentication,

35
01:27.230 --> 01:28.208 align:middle line:84%
lots of options.

36
01:28.208 --> 01:29.750 align:middle line:90%
So that give us the
most flexibility,

37
01:29.750 --> 01:33.068 align:middle line:90%
and then if we had multiple
interfaces on our website
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.750 --> 01:33.068 align:middle line:90%
and then if we had multiple
interfaces on our website

38
01:33.068 --> 01:34.610 align:middle line:90%
security appliance,
we could go ahead

39
01:34.610 --> 01:36.163 align:middle line:84%
and do set source interface.

40
01:36.163 --> 01:37.580 align:middle line:90%
And if we had
multiple interfaces,

41
01:37.580 --> 01:39.122 align:middle line:90%
we could also specify
which interface

42
01:39.122 --> 01:41.735 align:middle line:90%
we're using to communicate with
the Active Directory server.

43
01:41.735 --> 01:43.860 align:middle line:90%
In this case, I only have
the management interface,

44
01:43.860 --> 01:45.318 align:middle line:90%
which I'm using
for both management

45
01:45.318 --> 01:46.530 align:middle line:84%
and for proxy services.

46
01:46.530 --> 01:49.400 align:middle line:90%
So I have no options other
than the management interface.

47
01:49.400 --> 01:52.220 align:middle line:90%
And then we're going to specify
the IP address of our server.

48
01:52.220 --> 01:54.710 align:middle line:90%
If we go back to our topology,
our Active Directory server

49
01:54.710 --> 01:56.590 align:middle line:84%
is at .100 right here.

50
01:56.590 --> 02:01.310 align:middle line:90%
So we plug in that IP
address, 192.168.1.100.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:56.590 --> 02:01.310 align:middle line:90%
So we plug in that IP
address, 192.168.1.100.

51
02:01.310 --> 02:03.435 align:middle line:90%
And as a point of
interest, this WSA,

52
02:03.435 --> 02:05.060 align:middle line:90%
this web security
appliance, as well as

53
02:05.060 --> 02:07.280 align:middle line:90%
the Windows server
and some other gear,

54
02:07.280 --> 02:09.590 align:middle line:90%
is all running over here
on this rack of server

55
02:09.590 --> 02:11.037 align:middle line:84%
in a VMware environment.

56
02:11.037 --> 02:13.370 align:middle line:90%
So I'm going to go ahead and
specify my Active Directory

57
02:13.370 --> 02:15.200 align:middle line:84%
domain as ogit.com.

58
02:15.200 --> 02:17.790 align:middle line:90%
It just happened to be
that in my little lab here.

59
02:17.790 --> 02:20.960 align:middle line:90%
So once I supply the IP
address of the Active Directory

60
02:20.960 --> 02:23.173 align:middle line:90%
server and the Active
Directory domain,

61
02:23.173 --> 02:25.340 align:middle line:90%
I'll then go ahead and
scroll down just a little bit

62
02:25.340 --> 02:26.532 align:middle line:84%
and click on Join.

63
02:26.532 --> 02:28.490 align:middle line:90%
It's going to ask me for
credentials about some

64
02:28.490 --> 02:30.920 align:middle line:90%
of the inactive directory who
has the ability to do this,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:28.490 --> 02:30.920 align:middle line:90%
of the inactive directory who
has the ability to do this,

65
02:30.920 --> 02:35.630 align:middle line:90%
so I'll supply the
administrator credentials.

66
02:35.630 --> 02:37.790 align:middle line:90%
And the password associated
with that over there

67
02:37.790 --> 02:39.590 align:middle line:90%
on my Active Directory
server, and we'll

68
02:39.590 --> 02:42.860 align:middle line:90%
click on create account,
and we'll cross our fingers.

69
02:42.860 --> 02:44.370 align:middle line:90%
Let me scroll up
to the top here.

70
02:44.370 --> 02:46.203 align:middle line:90%
Now, one of the things
I had challenges with

71
02:46.203 --> 02:49.790 align:middle line:90%
is I didn't have DNS all dialed
in with everybody's names here,

72
02:49.790 --> 02:52.550 align:middle line:90%
and it barked at me a few times,
because it couldn't resolve

73
02:52.550 --> 02:54.120 align:middle line:84%
a certain IP address to a name.

74
02:54.120 --> 02:56.420 align:middle line:90%
So in the background, I also
tweaked the DNS services

75
02:56.420 --> 02:59.030 align:middle line:90%
on the Windows server so that
everything was resolvable.

76
02:59.030 --> 03:01.700 align:middle line:90%
Also what I did was I
went to network and DNS,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:59.030 --> 03:01.700 align:middle line:90%
Also what I did was I
went to network and DNS,

77
03:01.700 --> 03:04.190 align:middle line:90%
and I also told this
web security appliance

78
03:04.190 --> 03:05.840 align:middle line:90%
to use that Active
Directory server,

79
03:05.840 --> 03:08.280 align:middle line:90%
that Windows server as
a DNS server as well.

80
03:08.280 --> 03:10.445 align:middle line:90%
So that was a little hiccup
that I had to resolve,

81
03:10.445 --> 03:12.570 align:middle line:90%
and I wanted to pass that
tip along to you as well.

82
03:12.570 --> 03:14.070 align:middle line:84%
So make sure DNS works.

83
03:14.070 --> 03:16.028 align:middle line:90%
So once we've configured
this, it says success.

84
03:16.028 --> 03:17.278 align:middle line:84%
This is a really cool feature.

85
03:17.278 --> 03:18.780 align:middle line:90%
If we go down here
to the bottom,

86
03:18.780 --> 03:20.630 align:middle line:90%
we have an option for
test current settings,

87
03:20.630 --> 03:23.240 align:middle line:90%
so we click on start
test, it will literally

88
03:23.240 --> 03:25.040 align:middle line:90%
go out and test to
see whether or not

89
03:25.040 --> 03:27.120 align:middle line:90%
that integration between
this web security

90
03:27.120 --> 03:30.380 align:middle line:90%
appliance and Active Directory
server is currently working.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
03:27.120 --> 03:30.380 align:middle line:90%
appliance and Active Directory
server is currently working.

91
03:30.380 --> 03:32.900 align:middle line:90%
And it's starting off
with DNS resolution.

92
03:32.900 --> 03:33.760 align:middle line:84%
Here we go.

93
03:33.760 --> 03:36.290 align:middle line:90%
That's a great start, and
it's going to continue on.

94
03:36.290 --> 03:38.180 align:middle line:90%
And with any success,
and hopefully

95
03:38.180 --> 03:40.040 align:middle line:90%
it'll pass all the
tests, we can click on

96
03:40.040 --> 03:42.412 align:middle line:90%
submit, save our
changes, and then we'd

97
03:42.412 --> 03:44.120 align:middle line:90%
have integration
between the web security

98
03:44.120 --> 03:46.500 align:middle line:90%
appliance and our Active
Directory environment.

99
03:46.500 --> 03:49.310 align:middle line:90%
So I sped that up, but that took
about two minutes in real time,

100
03:49.310 --> 03:51.300 align:middle line:90%
and it says test
completed successfully.

101
03:51.300 --> 03:52.580 align:middle line:84%
So we'll click on submit here.

102
03:52.580 --> 03:54.410 align:middle line:90%
We need to go up to
the top right up here

103
03:54.410 --> 03:56.335 align:middle line:84%
and click on commit changes.

104
03:56.335 --> 03:57.710 align:middle line:90%
So we'll click on
commit changes,

105
03:57.710 --> 04:00.095 align:middle line:90%
and then it's going to ask
us to supply a note regarding
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
03:57.710 --> 04:00.095 align:middle line:90%
and then it's going to ask
us to supply a note regarding

106
04:00.095 --> 04:01.970 align:middle line:90%
this change or this
commit we're about to do,

107
04:01.970 --> 04:03.770 align:middle line:90%
and I've just added
add to the mix

108
04:03.770 --> 04:05.888 align:middle line:90%
for the benefit of
authentication and policy

109
04:05.888 --> 04:06.680 align:middle line:84%
that we can set up.

110
04:06.680 --> 04:08.660 align:middle line:90%
Now we'll go ahead and
click on commit changes,

111
04:08.660 --> 04:10.493 align:middle line:90%
and it says our changes
have been committed.

112
04:10.493 --> 04:11.030 align:middle line:84%
Success.

113
04:11.030 --> 04:11.930 align:middle line:84%
Fantastic.

114
04:11.930 --> 04:14.600 align:middle line:90%
So now that the web security
appliance knows about Active

115
04:14.600 --> 04:16.850 align:middle line:90%
Directory and how to communicate
with it and query it,

116
04:16.850 --> 04:19.490 align:middle line:90%
we can now use users
and group membership

117
04:19.490 --> 04:22.340 align:middle line:90%
in Active Directory as part
of our web security appliance

118
04:22.340 --> 04:23.203 align:middle line:84%
policies.

119
04:23.203 --> 04:25.620 align:middle line:90%
So we'll take a closer look
at policies in the next video.

120
04:25.620 --> 04:27.540 align:middle line:90%
I'll see you there
in just a moment.

121
04:27.540 --> 04:29.960 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

122
04:29.960 --> 04:33.340 align:middle line:90%
and I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:29.960 --> 04:33.340 align:middle line:90%
and I'd like to thank
you for viewing.