WEBVTT

1
00:00.000 --> 00:00.980 align:middle line:84%


2
00:00.980 --> 00:04.110 align:middle line:90%
In the previous video, we linked
or integrated Web Security

3
00:04.110 --> 00:05.780 align:middle line:90%
Appliance with Active
Directory, so it

4
00:05.780 --> 00:09.020 align:middle line:90%
can make queries and identify
a user or a member of a group.

5
00:09.020 --> 00:09.830 align:middle line:84%
That's fantastic.

6
00:09.830 --> 00:12.140 align:middle line:90%
But we have to as
part of our policies

7
00:12.140 --> 00:14.060 align:middle line:90%
have a way of
identifying or looking

8
00:14.060 --> 00:16.219 align:middle line:90%
for those specific users
or group membership.

9
00:16.219 --> 00:19.040 align:middle line:90%
And a big way of doing that
as part of our overall policy

10
00:19.040 --> 00:22.730 align:middle line:90%
with the WSA is to use
identity profiles, which are

11
00:22.730 --> 00:24.207 align:middle line:84%
critical to making that work.

12
00:24.207 --> 00:25.790 align:middle line:90%
So in this video,
I'd like to walk you

13
00:25.790 --> 00:29.240 align:middle line:90%
through the basic set up
and creation of an identity

14
00:29.240 --> 00:31.160 align:middle line:84%
profile on the WSA.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.240 --> 00:31.160 align:middle line:84%
profile on the WSA.

15
00:31.160 --> 00:33.500 align:middle line:90%
So on this virtual
appliance, this

16
00:33.500 --> 00:36.810 align:middle line:90%
is the My Dashboard page, which
is taking me to by default.

17
00:36.810 --> 00:39.050 align:middle line:90%
And if we want to create
an identity profile,

18
00:39.050 --> 00:42.110 align:middle line:90%
what we could do is go
to Web Security Manager,

19
00:42.110 --> 00:45.350 align:middle line:90%
and then under Authentication,
we can specify Identification

20
00:45.350 --> 00:46.527 align:middle line:84%
Profiles right here.

21
00:46.527 --> 00:48.485 align:middle line:90%
With that selected, it
is showing us right here

22
00:48.485 --> 00:51.380 align:middle line:90%
that it has a Global
Identification Profile that's

23
00:51.380 --> 00:53.990 align:middle line:90%
exempting from authentication,
meaning no one's ever going

24
00:53.990 --> 00:55.712 align:middle line:84%
to be asked for who they are.

25
00:55.712 --> 00:57.920 align:middle line:90%
It doesn't care if you're
an Active Directory or not,

26
00:57.920 --> 01:00.260 align:middle line:90%
we just don't care
by default. So case
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:57.920 --> 01:00.260 align:middle line:90%
we just don't care
by default. So case

27
01:00.260 --> 01:02.510 align:middle line:90%
in point, if we took a PC
that was currently using

28
01:02.510 --> 01:04.525 align:middle line:84%
the WSA as a proxy server.

29
01:04.525 --> 01:05.900 align:middle line:90%
In fact, I've got
one right here.

30
01:05.900 --> 01:07.520 align:middle line:90%
Let me bring him
in the view here.

31
01:07.520 --> 01:08.645 align:middle line:84%
If we opened up a browser--

32
01:08.645 --> 01:10.562 align:middle line:90%
I'll go ahead and use
Chrome in this example--

33
01:10.562 --> 01:12.950 align:middle line:90%
and we go to a website like
fireballwhiskey.com-- now,

34
01:12.950 --> 01:15.560 align:middle line:90%
I'm doing this intentionally
because perhaps we

35
01:15.560 --> 01:18.080 align:middle line:90%
have a policy that we shouldn't
have any customers going

36
01:18.080 --> 01:22.190 align:middle line:90%
to alcohol-related websites--
not only will the Web Security

37
01:22.190 --> 01:24.380 align:middle line:90%
Appliance be able to
identify this is happening,

38
01:24.380 --> 01:26.150 align:middle line:90%
but it can also go
ahead and stop it

39
01:26.150 --> 01:27.720 align:middle line:84%
once we put it in policy.

40
01:27.720 --> 01:29.600 align:middle line:90%
So this is from a
client currently

41
01:29.600 --> 01:33.348 align:middle line:90%
that's using as a proxy
server, it's using the WSA.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.600 --> 01:33.348 align:middle line:90%
that's using as a proxy
server, it's using the WSA.

42
01:33.348 --> 01:35.390 align:middle line:90%
And to verify that, just
going to type in "proxy"

43
01:35.390 --> 01:37.820 align:middle line:84%
here for our proxy settings.

44
01:37.820 --> 01:40.110 align:middle line:90%
Here it's showing the IP
address of the proxy server.

45
01:40.110 --> 01:41.680 align:middle line:84%
It's also showing the port.

46
01:41.680 --> 01:43.340 align:middle line:84%
Now this port of 3128.

47
01:43.340 --> 01:45.350 align:middle line:90%
Now this port of
3128 is the port

48
01:45.350 --> 01:47.990 align:middle line:90%
that's also listening and
configured at the Web Security

49
01:47.990 --> 01:48.630 align:middle line:84%
Appliance.

50
01:48.630 --> 01:50.253 align:middle line:90%
Now for a large
number of devices,

51
01:50.253 --> 01:52.670 align:middle line:90%
we wouldn't want to do this
manually because two reasons--

52
01:52.670 --> 01:54.470 align:middle line:90%
a user may be able
to turn this off

53
01:54.470 --> 01:57.200 align:middle line:90%
and also if we have lots of
users, like thousands of users,

54
01:57.200 --> 02:00.110 align:middle line:90%
we'd want to do this through
policy and have it automated
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:57.200 --> 02:00.110 align:middle line:90%
we'd want to do this through
policy and have it automated

55
02:00.110 --> 02:01.460 align:middle line:84%
and not have to do it manual.

56
02:01.460 --> 02:03.210 align:middle line:90%
So anyway, I want to
show you that this is

57
02:03.210 --> 02:04.610 align:middle line:84%
going through the proxy server.

58
02:04.610 --> 02:06.620 align:middle line:90%
And because the default
Identification Profile

59
02:06.620 --> 02:08.120 align:middle line:84%
says exempt from authentication.

60
02:08.120 --> 02:10.039 align:middle line:90%
They also exempt from
user identification,

61
02:10.039 --> 02:12.539 align:middle line:90%
basically saying, great, we're
not going to ask who you are.

62
02:12.539 --> 02:13.280 align:middle line:84%
Just go on.

63
02:13.280 --> 02:15.072 align:middle line:90%
And then it's using
default policies as far

64
02:15.072 --> 02:17.197 align:middle line:90%
as what's being allowed
and what's being monitored.

65
02:17.197 --> 02:18.950 align:middle line:90%
And that's why if we
go back to Reporting

66
02:18.950 --> 02:22.070 align:middle line:90%
and go to My Dashboard
and we scroll down, here

67
02:22.070 --> 02:25.190 align:middle line:90%
it's showing us under Alcohol
in the top URL categories

68
02:25.190 --> 02:26.275 align:middle line:84%
that we've had a few hits.

69
02:26.275 --> 02:27.650 align:middle line:90%
And that's all on
that one client

70
02:27.650 --> 02:28.910 align:middle line:84%
going to various websites.

71
02:28.910 --> 02:30.710 align:middle line:90%
However, the system
does not yet know
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:28.910 --> 02:30.710 align:middle line:90%
However, the system
does not yet know

72
02:30.710 --> 02:32.660 align:middle line:90%
what the user is behind
those transactions

73
02:32.660 --> 02:34.580 align:middle line:90%
because it's not using
authentication yet,

74
02:34.580 --> 02:36.770 align:middle line:90%
and also it's not doing
any blocking by default

75
02:36.770 --> 02:37.955 align:middle line:84%
of any URL categories.

76
02:37.955 --> 02:39.830 align:middle line:90%
We can change all that
and we will change all

77
02:39.830 --> 02:42.180 align:middle line:90%
that as we proceed through
these videos together.

78
02:42.180 --> 02:43.760 align:middle line:90%
So to create an
identity profile,

79
02:43.760 --> 02:46.820 align:middle line:90%
we go to Web Security
Manager and Authentication,

80
02:46.820 --> 02:48.890 align:middle line:84%
we click on Identity Profiles.

81
02:48.890 --> 02:51.980 align:middle line:90%
From here, we click on Add
Identification Profile,

82
02:51.980 --> 02:53.610 align:middle line:90%
and then we simply
give it a name.

83
02:53.610 --> 02:56.077 align:middle line:84%
Let's call this "OurProfileOne."

84
02:56.077 --> 02:58.160 align:middle line:90%
And you could name it
something that's meaningful,

85
02:58.160 --> 03:00.000 align:middle line:90%
but this is our first one
we're creating together.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
03:00.000 --> 03:00.917 align:middle line:84%
Give it a description.

87
03:00.917 --> 03:03.500 align:middle line:90%
And it's also asking where do
we want to put this new profile.

88
03:03.500 --> 03:05.810 align:middle line:90%
Now we have the default
global profiles at the bottom.

89
03:05.810 --> 03:07.940 align:middle line:90%
We're going to put in
front or on top of that

90
03:07.940 --> 03:10.340 align:middle line:90%
because it's our only other
profile we have to play with.

91
03:10.340 --> 03:12.680 align:middle line:90%
And then down on our user
identification method,

92
03:12.680 --> 03:14.615 align:middle line:90%
we can click here and
we can specify that we

93
03:14.615 --> 03:15.740 align:middle line:84%
want to authenticate users.

94
03:15.740 --> 03:17.645 align:middle line:90%
Now, if we had not
yet set up, as we

95
03:17.645 --> 03:19.520 align:middle line:90%
did in the previous
video-- if we had not yet

96
03:19.520 --> 03:21.322 align:middle line:90%
set up Active
Directory integration,

97
03:21.322 --> 03:23.780 align:middle line:90%
we wouldn't even have an option
here for Authenticate Users

98
03:23.780 --> 03:25.618 align:middle line:90%
because it has no
source to go to.

99
03:25.618 --> 03:27.660 align:middle line:90%
So we'll go ahead and
specify Authenticate Users.

100
03:27.660 --> 03:29.120 align:middle line:90%
Then it's going to
ask us about our realm

101
03:29.120 --> 03:30.703 align:middle line:90%
that we want to use
for authenticating
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
03:29.120 --> 03:30.703 align:middle line:90%
that we want to use
for authenticating

102
03:30.703 --> 03:32.280 align:middle line:84%
those users and the method.

103
03:32.280 --> 03:33.830 align:middle line:84%
So here we have several options.

104
03:33.830 --> 03:36.805 align:middle line:90%
Now for the lab, I'm going to
go ahead and use basic, which--

105
03:36.805 --> 03:38.930 align:middle line:90%
this is not convenient for
a production environment

106
03:38.930 --> 03:40.180 align:middle line:84%
because it's going to prompt--

107
03:40.180 --> 03:42.135 align:middle line:90%
every time the traffic
hits the proxy server

108
03:42.135 --> 03:44.510 align:middle line:90%
it's going to prompt them
initially and say, who are you?

109
03:44.510 --> 03:46.290 align:middle line:90%
And then they have to
provide their credentials.

110
03:46.290 --> 03:48.200 align:middle line:90%
So for a production
environment, where our user's

111
03:48.200 --> 03:49.700 align:middle line:90%
authenticated to
their local machine

112
03:49.700 --> 03:51.890 align:middle line:90%
and is very actively
involved in the domain,

113
03:51.890 --> 03:54.470 align:middle line:90%
we could use other options
like Kerberos or NTLMSSP,

114
03:54.470 --> 03:57.197 align:middle line:90%
so that the user wouldn't
have to re-authenticate.

115
03:57.197 --> 03:59.030 align:middle line:90%
That's one of the
benefits of single sign-on

116
03:59.030 --> 04:01.530 align:middle line:90%
is that you don't have to
sign on over and over again.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
03:59.030 --> 04:01.530 align:middle line:90%
is that you don't have to
sign on over and over again.

117
04:01.530 --> 04:03.800 align:middle line:90%
However, for the lab, I'm
going to specify basic

118
04:03.800 --> 04:06.110 align:middle line:90%
and that way is going
to require us every time

119
04:06.110 --> 04:08.652 align:middle line:90%
if something is not cached for
me to force an authentication.

120
04:08.652 --> 04:10.777 align:middle line:90%
And then if you scroll down
just a little bit more,

121
04:10.777 --> 04:13.310 align:middle line:90%
we have options for persistent
cookies or session cookies,

122
04:13.310 --> 04:15.380 align:middle line:90%
and that way when a user
has been authenticated,

123
04:15.380 --> 04:17.899 align:middle line:90%
it can remember that
individual based on the cookie

124
04:17.899 --> 04:20.029 align:middle line:90%
if we specify it, and
that way it won't have

125
04:20.029 --> 04:21.660 align:middle line:84%
to re-authenticate them again.

126
04:21.660 --> 04:23.630 align:middle line:90%
So for the lab, I'm going
to specify Use Basic,

127
04:23.630 --> 04:26.670 align:middle line:90%
so it can prompt me every
time and not use any cookies,

128
04:26.670 --> 04:28.962 align:middle line:90%
so it can have a better
chance of reproving

129
04:28.962 --> 04:31.170 align:middle line:90%
who I am if I want to go to
a different user account.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:28.962 --> 04:31.170 align:middle line:90%
who I am if I want to go to
a different user account.

130
04:31.170 --> 04:33.470 align:middle line:90%
We can additionally
restrict the matching

131
04:33.470 --> 04:36.238 align:middle line:90%
on this identity profile based
on the subnet or IP address

132
04:36.238 --> 04:37.280 align:middle line:84%
that they're coming from.

133
04:37.280 --> 04:39.238 align:middle line:90%
I'm not going to add that
restriction to my lab

134
04:39.238 --> 04:41.670 align:middle line:90%
but we could, if we
wanted for example,

135
04:41.670 --> 04:43.970 align:middle line:90%
users that are only coming
from a certain IP address

136
04:43.970 --> 04:45.890 align:middle line:84%
to match this identity profile.

137
04:45.890 --> 04:47.360 align:middle line:90%
And then when we
get to policies,

138
04:47.360 --> 04:50.150 align:middle line:90%
I'll show you how we can specify
which profile has to match

139
04:50.150 --> 04:51.595 align:middle line:84%
for a policy to kick in.

140
04:51.595 --> 04:52.970 align:middle line:90%
So I'm going to
leave this empty.

141
04:52.970 --> 04:56.300 align:middle line:90%
I'm also going to leave the
checkbox next to HTTP and HTTPS

142
04:56.300 --> 04:57.770 align:middle line:84%
and then click on Submit.

143
04:57.770 --> 04:59.940 align:middle line:90%
And when we click on
Submit, it's not over.

144
04:59.940 --> 05:02.310 align:middle line:90%
We also now this option in
the upper right hand corner
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
04:59.940 --> 05:02.310 align:middle line:90%
We also now this option in
the upper right hand corner

145
05:02.310 --> 05:03.870 align:middle line:90%
called Commit Changes,
which actually

146
05:03.870 --> 05:05.770 align:middle line:84%
makes those changes real.

147
05:05.770 --> 05:08.190 align:middle line:90%
So we'll go ahead and
click on Commits Changes

148
05:08.190 --> 05:10.850 align:middle line:90%
and then add a comment
and Commit and give

149
05:10.850 --> 05:11.850 align:middle line:84%
that a second to finish.

150
05:11.850 --> 05:13.020 align:middle line:90%
And now if we go
back to our client

151
05:13.020 --> 05:14.103 align:middle line:84%
and open a browser again--

152
05:14.103 --> 05:16.710 align:middle line:90%
I'm going to open up a
incognito window once more--

153
05:16.710 --> 05:18.480 align:middle line:90%
and go to Fireball
Whiskey because we're

154
05:18.480 --> 05:21.300 align:middle line:90%
going through the proxy
and authentication profiles

155
05:21.300 --> 05:23.790 align:middle line:90%
are being match, it's asking
us who the heck we are.

156
05:23.790 --> 05:26.310 align:middle line:90%
And so I'm going to go ahead
and specify my name as "Bob"

157
05:26.310 --> 05:27.810 align:middle line:84%
and my password is this.

158
05:27.810 --> 05:31.590 align:middle line:84%
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
05:27.810 --> 05:31.590 align:middle line:84%


159
05:31.590 --> 05:33.360 align:middle line:90%
Now here's the funny
thing, I didn't

160
05:33.360 --> 05:35.205 align:middle line:90%
realize I had a "Bob"
account, but I must.

161
05:35.205 --> 05:36.870 align:middle line:90%
Let's go check
Active Directory just

162
05:36.870 --> 05:40.380 align:middle line:90%
to verify I really do have
a user account called "Bob."

163
05:40.380 --> 05:42.420 align:middle line:84%
so this is my vSphere Console.

164
05:42.420 --> 05:46.810 align:middle line:90%
Let's go to the 2019 Server,
open a console to it.

165
05:46.810 --> 05:48.330 align:middle line:84%
I'll go ahead and log in.

166
05:48.330 --> 05:52.740 align:middle line:90%
Close DNS Manager, go to
Tools, Active Directory Users

167
05:52.740 --> 05:54.420 align:middle line:90%
and Computers, and
sure enough, I've

168
05:54.420 --> 05:56.910 align:middle line:90%
got a user named Bob and
I've got a user named Louis.

169
05:56.910 --> 05:58.560 align:middle line:90%
So we could actually
use either one

170
05:58.560 --> 06:00.270 align:middle line:90%
of those names for
the authentication
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
05:58.560 --> 06:00.270 align:middle line:90%
of those names for
the authentication

171
06:00.270 --> 06:01.230 align:middle line:84%
and it should work.

172
06:01.230 --> 06:03.188 align:middle line:90%
In fact, let me just
check out Louis real quick

173
06:03.188 --> 06:05.520 align:middle line:90%
and if that works, we'll
use those two accounts going

174
06:05.520 --> 06:06.160 align:middle line:84%
forward.

175
06:06.160 --> 06:09.030 align:middle line:90%
So here we'll go ahead and close
the browser, we'll open it up,

176
06:09.030 --> 06:12.680 align:middle line:84%
and we'll just go to google.com.

177
06:12.680 --> 06:14.430 align:middle line:90%
And because we're going
through the proxy,

178
06:14.430 --> 06:15.843 align:middle line:84%
we'll log in as Louis.

179
06:15.843 --> 06:17.260 align:middle line:90%
Hopefully I remember
the password.

180
06:17.260 --> 06:20.170 align:middle line:90%
Click Sign In, and sure
enough, we are there.

181
06:20.170 --> 06:20.940 align:middle line:84%
Fantastic.

182
06:20.940 --> 06:21.540 align:middle line:84%
All right.

183
06:21.540 --> 06:23.790 align:middle line:90%
Also, if we go back to
the Web Security Appliance

184
06:23.790 --> 06:27.090 align:middle line:90%
and go to Reporting and
then go to URL categories

185
06:27.090 --> 06:28.770 align:middle line:90%
and scroll down a
little bit, here we

186
06:28.770 --> 06:30.390 align:middle line:90%
have some for
alcohol, which I've
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

186
06:28.770 --> 06:30.390 align:middle line:90%
have some for
alcohol, which I've

187
06:30.390 --> 06:32.520 align:middle line:90%
gone to a few times in
this test environment.

188
06:32.520 --> 06:35.040 align:middle line:90%
And by default, it's
monitoring that traffic,

189
06:35.040 --> 06:37.350 align:middle line:90%
it's allowing it to happen,
it's not blocking it.

190
06:37.350 --> 06:39.780 align:middle line:90%
Now to actually block
the traffic, what we also

191
06:39.780 --> 06:42.130 align:middle line:90%
need in conjunction with an
identity profile that says,

192
06:42.130 --> 06:42.715 align:middle line:84%
who are you?

193
06:42.715 --> 06:44.340 align:middle line:90%
We also are going to
need a policy that

194
06:44.340 --> 06:46.440 align:middle line:90%
says this is allowed
or this is not allowed,

195
06:46.440 --> 06:48.315 align:middle line:90%
and that's we're going
to take a look at more

196
06:48.315 --> 06:49.420 align:middle line:84%
closely in the next video.

197
06:49.420 --> 06:51.370 align:middle line:90%
I'll see you there
in just a moment.

198
06:51.370 --> 06:53.760 align:middle line:90%
Meanwhile, I hope this has
been informative for you

199
06:53.760 --> 06:57.140 align:middle line:90%
and I'd like to thank
you for viewing.