WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:03.065 align:middle line:90%
In the previous video, we
created an identity profile

3
00:03.065 --> 00:04.690 align:middle line:90%
that lets us leverage
Active Directory.

4
00:04.690 --> 00:07.600 align:middle line:90%
However, it's not too
helpful yet because we

5
00:07.600 --> 00:10.030 align:middle line:90%
haven't associated that
with a policy about what

6
00:10.030 --> 00:11.800 align:middle line:84%
we're allowing or not allowing.

7
00:11.800 --> 00:14.440 align:middle line:90%
We're going to correct that
by creating a new access

8
00:14.440 --> 00:17.050 align:middle line:90%
policy that gets a little
more tougher on what

9
00:17.050 --> 00:20.538 align:middle line:90%
categories of URLs an individual
named Bob is allowed to go to.

10
00:20.538 --> 00:22.705 align:middle line:90%
So I've just logged into
the Web Security Appliance.

11
00:22.705 --> 00:24.310 align:middle line:84%
This is the My Dashboard page.

12
00:24.310 --> 00:26.710 align:middle line:90%
And if we scroll down
to URL categories,

13
00:26.710 --> 00:28.480 align:middle line:84%
notice that we have alcohol.

14
00:28.480 --> 00:30.340 align:middle line:90%
We've got some events
or transactions
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.480 --> 00:30.340 align:middle line:90%
We've got some events
or transactions

15
00:30.340 --> 00:31.870 align:middle line:84%
regarding an alcohol website.

16
00:31.870 --> 00:34.180 align:middle line:90%
So if we wanted to filter
that for a certain user,

17
00:34.180 --> 00:36.280 align:middle line:90%
we could simply create a
policy to pull that off.

18
00:36.280 --> 00:39.640 align:middle line:90%
And to do that, we go to Web
Security Manager and then

19
00:39.640 --> 00:42.890 align:middle line:90%
on the dropdown, we select
Access Policies right here.

20
00:42.890 --> 00:45.730 align:middle line:90%
So this is the default
Global Access Policy

21
00:45.730 --> 00:48.160 align:middle line:90%
that monitors 86
different categories as

22
00:48.160 --> 00:49.600 align:middle line:84%
of this version of software.

23
00:49.600 --> 00:52.420 align:middle line:90%
86 different categories
based on your URL filtering

24
00:52.420 --> 00:53.530 align:middle line:84%
and applications--

25
00:53.530 --> 00:57.680 align:middle line:90%
345, but it's not stopping or
denying any traffic by default.

26
00:57.680 --> 00:58.850 align:middle line:84%
So what we could do is this.

27
00:58.850 --> 01:01.010 align:middle line:90%
We could modify
the global policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.850 --> 01:01.010 align:middle line:90%
We could modify
the global policy.

28
01:01.010 --> 01:04.330 align:middle line:90%
So at our company if we want
to say alcohol-related sites,

29
01:04.330 --> 01:06.703 align:middle line:90%
gaming-related sites,
nobody gets there,

30
01:06.703 --> 01:08.620 align:middle line:90%
we could modify the
default-- that'd be great,

31
01:08.620 --> 01:10.600 align:middle line:90%
or we could create
an additional policy

32
01:10.600 --> 01:12.820 align:middle line:90%
and place it above it
that would match on,

33
01:12.820 --> 01:14.950 align:middle line:90%
for example, a certain
group or a certain user

34
01:14.950 --> 01:16.150 align:middle line:84%
and apply that policy.

35
01:16.150 --> 01:18.160 align:middle line:90%
And these are processed
going top down.

36
01:18.160 --> 01:20.030 align:middle line:90%
So when there's a
match-- for example,

37
01:20.030 --> 01:21.952 align:middle line:90%
if Bob is matched
via authentication,

38
01:21.952 --> 01:23.410 align:middle line:90%
and then we have
a policy that says

39
01:23.410 --> 01:26.500 align:middle line:90%
he can't go to alcohol websites
or alcohol-related categories,

40
01:26.500 --> 01:29.020 align:middle line:90%
then it would drop his traffic
or not allow the traffic.

41
01:29.020 --> 01:32.140 align:middle line:90%
And even if there was a policy
that was more lenient below,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.020 --> 01:32.140 align:middle line:90%
And even if there was a policy
that was more lenient below,

42
01:32.140 --> 01:34.277 align:middle line:90%
once he has a match,
that match is executed,

43
01:34.277 --> 01:36.610 align:middle line:90%
and then Bob at that point
is either permitted or denied

44
01:36.610 --> 01:38.513 align:middle line:90%
based on the policy
to that website

45
01:38.513 --> 01:39.680 align:middle line:84%
that he was trying to reach.

46
01:39.680 --> 01:40.790 align:middle line:84%
So here's what I propose we do.

47
01:40.790 --> 01:42.248 align:middle line:90%
Let's create a new
policy and we'll

48
01:42.248 --> 01:45.020 align:middle line:90%
add it before the Global
Policy, so it'll catch first.

49
01:45.020 --> 01:46.270 align:middle line:84%
So we'll click on Add Policy.

50
01:46.270 --> 01:49.960 align:middle line:90%
And let's call it
"NoDrinksForBob."

51
01:49.960 --> 01:51.460 align:middle line:90%
And what we'll do
in this policy is

52
01:51.460 --> 01:53.680 align:middle line:90%
we'll go ahead and place
it above the Global Policy.

53
01:53.680 --> 01:54.880 align:middle line:90%
That's what we're
specifying here.

54
01:54.880 --> 01:56.470 align:middle line:90%
We can put a description
here, and that description

55
01:56.470 --> 01:57.845 align:middle line:90%
is going to be
very helpful later

56
01:57.845 --> 02:01.540 align:middle line:90%
for us just to remind ourselves
and what this policy was for.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
01:57.845 --> 02:01.540 align:middle line:90%
for us just to remind ourselves
and what this policy was for.

57
02:01.540 --> 02:04.040 align:middle line:90%
"NoDrinksForBob" is pretty
clear though in the title there.

58
02:04.040 --> 02:07.240 align:middle line:90%
And if we scroll down, we can
then specify the conditions

59
02:07.240 --> 02:08.657 align:middle line:84%
for this policy.

60
02:08.657 --> 02:10.990 align:middle line:90%
So we can say we want to use
all identification profiles

61
02:10.990 --> 02:14.478 align:middle line:90%
or we could choose one or more
of the identification profiles

62
02:14.478 --> 02:15.270 align:middle line:84%
that we've created.

63
02:15.270 --> 02:16.770 align:middle line:90%
Now at this point
in the show, we've

64
02:16.770 --> 02:18.560 align:middle line:90%
only created one
identification profile.

65
02:18.560 --> 02:21.552 align:middle line:90%
So if we select it here,
called "OurProfileOne,"

66
02:21.552 --> 02:22.760 align:middle line:84%
it would then pull from that.

67
02:22.760 --> 02:24.427 align:middle line:90%
And then it says All
Authenticated Users

68
02:24.427 --> 02:26.290 align:middle line:90%
or if you want t select
just a certain user.

69
02:26.290 --> 02:29.410 align:middle line:90%
So I click the radio button for
just a specific user or group.

70
02:29.410 --> 02:31.780 align:middle line:90%
And then for users, we'll
click on No users entered,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:29.410 --> 02:31.780 align:middle line:90%
And then for users, we'll
click on No users entered,

71
02:31.780 --> 02:33.160 align:middle line:84%
and we'll change that.

72
02:33.160 --> 02:36.610 align:middle line:90%
And I'm going to specify if
it's Bob, that would be a match.

73
02:36.610 --> 02:38.290 align:middle line:84%
And we'll click on Done.

74
02:38.290 --> 02:40.870 align:middle line:90%
So we're creating this policy
called "NoDrinksForBob."

75
02:40.870 --> 02:43.870 align:middle line:90%
It's going to match using
the "OurProfileOne,"

76
02:43.870 --> 02:46.468 align:middle line:90%
it's going to look for a
user specifically called Bob.

77
02:46.468 --> 02:48.760 align:middle line:90%
Now a great question that we
should be asking ourselves

78
02:48.760 --> 02:51.790 align:middle line:90%
right now, is we just
created this policy

79
02:51.790 --> 02:54.293 align:middle line:90%
and it's going to match on
Bob, but it didn't say what

80
02:54.293 --> 02:55.460 align:middle line:84%
we're going to do about Bob?

81
02:55.460 --> 02:57.430 align:middle line:90%
Are we going to allow
these categories of URLs?

82
02:57.430 --> 02:58.430 align:middle line:84%
Are we going to deny it?

83
02:58.430 --> 02:59.710 align:middle line:84%
How do we set that up?

84
02:59.710 --> 03:01.430 align:middle line:84%
Let me show you that right now.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
02:59.710 --> 03:01.430 align:middle line:84%
Let me show you that right now.

85
03:01.430 --> 03:04.000 align:middle line:90%
So now we have this policy
called "NoDrinksForBob,"

86
03:04.000 --> 03:06.430 align:middle line:90%
and by default as far as URL
filtering and everything else

87
03:06.430 --> 03:08.830 align:middle line:90%
across here, it's
using the same defaults

88
03:08.830 --> 03:10.300 align:middle line:84%
as the global policies.

89
03:10.300 --> 03:13.330 align:middle line:90%
So what we do for this policy
click here and we can modify,

90
03:13.330 --> 03:16.760 align:middle line:90%
we can change the defaults
regarding this specific policy.

91
03:16.760 --> 03:18.370 align:middle line:90%
So this is going
to match on Bob,

92
03:18.370 --> 03:20.410 align:middle line:90%
and then we can also
specify the actions

93
03:20.410 --> 03:22.840 align:middle line:90%
based on that match of
what Bob will or will not

94
03:22.840 --> 03:25.000 align:middle line:90%
be able to reach
based on URL filtering

95
03:25.000 --> 03:26.662 align:middle line:84%
if we modify it right here.

96
03:26.662 --> 03:27.370 align:middle line:84%
So let's do that.

97
03:27.370 --> 03:28.990 align:middle line:90%
We'll click here in
our policy we just

98
03:28.990 --> 03:31.120 align:middle line:90%
created under URL filtering
and then from here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:28.990 --> 03:31.120 align:middle line:90%
created under URL filtering
and then from here

99
03:31.120 --> 03:34.220 align:middle line:90%
we can specify exactly what we
want to have in this policy.

100
03:34.220 --> 03:35.765 align:middle line:90%
So as an example,
we'll grab Alcohol.

101
03:35.765 --> 03:38.140 align:middle line:90%
We've already proven that we
can get to a site like that,

102
03:38.140 --> 03:40.070 align:middle line:90%
and we'll just click
on Block right here.

103
03:40.070 --> 03:42.490 align:middle line:90%
So if this policy
matches if it's Bob,

104
03:42.490 --> 03:45.220 align:middle line:90%
and he's trying to go to
an alcohol-related website,

105
03:45.220 --> 03:46.780 align:middle line:90%
the Web Security
Alliance is going

106
03:46.780 --> 03:48.640 align:middle line:90%
to block him because
of this policy

107
03:48.640 --> 03:50.810 align:middle line:90%
once we save and
commit the changes.

108
03:50.810 --> 03:52.760 align:middle line:90%
So there is a Submit
button right here,

109
03:52.760 --> 03:53.830 align:middle line:90%
which I'm going to
go ahead and click.

110
03:53.830 --> 03:55.497 align:middle line:90%
And then we have a
bunch of changes that

111
03:55.497 --> 03:56.740 align:middle line:84%
have not been committed yet.

112
03:56.740 --> 03:58.330 align:middle line:90%
In fact, this whole
policy itself,

113
03:58.330 --> 04:00.190 align:middle line:90%
that's "NoDrinksForBob,"
including
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
03:58.330 --> 04:00.190 align:middle line:90%
that's "NoDrinksForBob,"
including

114
04:00.190 --> 04:03.103 align:middle line:90%
the block on alcohol-related
websites-- none of that's

115
04:03.103 --> 04:05.020 align:middle line:90%
going to be effective
until we click on Commit

116
04:05.020 --> 04:06.440 align:middle line:84%
up here in the upper right.

117
04:06.440 --> 04:10.990 align:middle line:90%
So we'll click on it and we'll
say, "Sorry, Bob," and click

118
04:10.990 --> 04:14.260 align:middle line:90%
on Commit Changes, and in a
moment, that'll be active.

119
04:14.260 --> 04:16.899 align:middle line:90%
So once this is all done, we
get a confirmation message

120
04:16.899 --> 04:19.930 align:middle line:90%
that it happened, we'll go ahead
and test it from both Louis

121
04:19.930 --> 04:22.150 align:middle line:90%
and also from Bob,
and we'll verify

122
04:22.150 --> 04:26.290 align:middle line:90%
that Louis won't match this
first policy because his name

123
04:26.290 --> 04:28.895 align:middle line:90%
isn't Bob, which is part of
the policy, and as a result,

124
04:28.895 --> 04:30.520 align:middle line:90%
he should be allowed
to go ahead and go
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
04:28.895 --> 04:30.520 align:middle line:90%
he should be allowed
to go ahead and go

125
04:30.520 --> 04:31.962 align:middle line:84%
to any website in any category.

126
04:31.962 --> 04:33.920 align:middle line:90%
On the other hand, if
we're Bob when we log in,

127
04:33.920 --> 04:36.680 align:middle line:90%
it'll match on this first
policy, and then as a result,

128
04:36.680 --> 04:39.070 align:middle line:90%
the alcohol-related
websites will be blocked.

129
04:39.070 --> 04:41.060 align:middle line:90%
So let's go and test
with Louis first.

130
04:41.060 --> 04:42.730 align:middle line:90%
So we're open up a
browser and we'll

131
04:42.730 --> 04:44.410 align:middle line:90%
go to fireballwhiskey.com,
we'll log in

132
04:44.410 --> 04:50.150 align:middle line:90%
as Louis, supply the password,
press Enter, and away he goes.

133
04:50.150 --> 04:50.650 align:middle line:84%
All right.

134
04:50.650 --> 04:51.670 align:middle line:84%
So that was successful.

135
04:51.670 --> 04:54.490 align:middle line:90%
I'll close that window and
let me open a browser again.

136
04:54.490 --> 04:56.510 align:middle line:90%
Also if there's
information that's cached,

137
04:56.510 --> 04:58.510 align:middle line:90%
you might want to just
verify that your cache is

138
04:58.510 --> 05:00.420 align:middle line:90%
cleared before you do
each of these attempts.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
04:58.510 --> 05:00.420 align:middle line:90%
cleared before you do
each of these attempts.

139
05:00.420 --> 05:02.045 align:middle line:90%
So we'll go to that
site one more time.

140
05:02.045 --> 05:05.160 align:middle line:84%
This time, we'll log on as Bob.

141
05:05.160 --> 05:07.950 align:middle line:90%
This is the WSA authentication
being done against the Active

142
05:07.950 --> 05:08.940 align:middle line:84%
Directory server.

143
05:08.940 --> 05:09.960 align:middle line:84%
Click on Sign In.

144
05:09.960 --> 05:11.590 align:middle line:84%
Oh my gosh, it's still working.

145
05:11.590 --> 05:12.420 align:middle line:84%
Why is that?

146
05:12.420 --> 05:12.930 align:middle line:84%
Oh!

147
05:12.930 --> 05:14.305 align:middle line:90%
And that looks
like it's working.

148
05:14.305 --> 05:17.280 align:middle line:90%
Hmm, let me go ahead and
let me bring up incognito.

149
05:17.280 --> 05:21.090 align:middle line:90%
So New Incognito Window and
we'll try that one more time.

150
05:21.090 --> 05:25.740 align:middle line:90%
We go to Fireball Whiskey,
log in as Bob, authenticate,

151
05:25.740 --> 05:27.768 align:middle line:84%
click on Sign In, there we go.

152
05:27.768 --> 05:28.560 align:middle line:84%
That's much better.

153
05:28.560 --> 05:31.350 align:middle line:90%
And just for fun, let me go
ahead and try it with Louis one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

153
05:28.560 --> 05:31.350 align:middle line:90%
And just for fun, let me go
ahead and try it with Louis one

154
05:31.350 --> 05:33.990 align:middle line:90%
more time in incognito
mode just to do an apples

155
05:33.990 --> 05:35.290 align:middle line:84%
to apples comparison here.

156
05:35.290 --> 05:37.710 align:middle line:90%
So we'll go to
Fireball Whiskey again,

157
05:37.710 --> 05:42.150 align:middle line:90%
I'll log in as
Louis, press Enter,

158
05:42.150 --> 05:44.920 align:middle line:90%
and sure enough, this time
no problem whatsoever.

159
05:44.920 --> 05:47.070 align:middle line:90%
And I'm going to say
that Louis is over 18.

160
05:47.070 --> 05:49.380 align:middle line:90%
So in this video, we've
created an access policy

161
05:49.380 --> 05:52.290 align:middle line:90%
that specifically, if it was
Bob based on the matching,

162
05:52.290 --> 05:54.810 align:middle line:90%
it was going to deny Bob
from going to any websites

163
05:54.810 --> 05:57.960 align:middle line:90%
in the category of alcohol
based on the URL filtering.

164
05:57.960 --> 06:00.598 align:middle line:90%
Now there's more that we
can do with access policies.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

164
05:57.960 --> 06:00.598 align:middle line:90%
Now there's more that we
can do with access policies.

165
06:00.598 --> 06:02.640 align:middle line:90%
So let's continue this
discussion about what else

166
06:02.640 --> 06:05.098 align:middle line:90%
we can control and restrict
with the Web Security Appliance

167
06:05.098 --> 06:06.400 align:middle line:84%
in the very next video.

168
06:06.400 --> 06:08.500 align:middle line:90%
So I'll see you there
in just a moment.

169
06:08.500 --> 06:10.830 align:middle line:90%
Meanwhile, I hope this has
been informative for you

170
06:10.830 --> 06:14.060 align:middle line:90%
and I'd like to thank
you for viewing.