WEBVTT

1
00:00.000 --> 00:01.180 align:middle line:84%


2
00:01.180 --> 00:02.830 align:middle line:90%
In this video, you
and I get to chat

3
00:02.830 --> 00:05.680 align:middle line:90%
about the topology, and
components, and pieces that

4
00:05.680 --> 00:08.320 align:middle line:90%
allow our clients and
customers, like Bob's computer,

5
00:08.320 --> 00:10.900 align:middle line:90%
to leverage Umbrella
and stay safe.

6
00:10.900 --> 00:12.730 align:middle line:90%
So let's leverage
this topology again

7
00:12.730 --> 00:15.880 align:middle line:90%
and take a look at how we
can start using Umbrella

8
00:15.880 --> 00:17.440 align:middle line:84%
to protect Bob's computer.

9
00:17.440 --> 00:19.570 align:middle line:90%
Now, we have a couple
of IP addresses

10
00:19.570 --> 00:23.650 align:middle line:90%
that represent the Cisco
Umbrella DNS servers up

11
00:23.650 --> 00:25.300 align:middle line:84%
in the cloud on the internet.

12
00:25.300 --> 00:27.280 align:middle line:84%
And here are those addresses.

13
00:27.280 --> 00:32.710 align:middle line:90%
They are 208.67.222.222, and
then the same first 16 bits,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:27.280 --> 00:32.710 align:middle line:90%
They are 208.67.222.222, and
then the same first 16 bits,

14
00:32.710 --> 00:34.480 align:middle line:84%
and then 220.220.

15
00:34.480 --> 00:37.900 align:middle line:90%
Now, the key is anybody can
point to those IP addresses

16
00:37.900 --> 00:40.540 align:middle line:90%
for DNS services, and
they're immediately

17
00:40.540 --> 00:42.293 align:middle line:90%
going to get some
additional benefits.

18
00:42.293 --> 00:43.960 align:middle line:90%
So right out of the
gate, Bob's computer

19
00:43.960 --> 00:45.820 align:middle line:90%
pointed to those IP
addresses for DNS

20
00:45.820 --> 00:47.500 align:middle line:90%
is going to make
him more secure,

21
00:47.500 --> 00:49.810 align:middle line:90%
because the default
policies on those servers

22
00:49.810 --> 00:52.090 align:middle line:90%
is if they know that
a website's malicious

23
00:52.090 --> 00:54.790 align:middle line:90%
that we're trying to get name
resolution for, they simply

24
00:54.790 --> 00:56.847 align:middle line:90%
won't forward the
real IP address to us.

25
00:56.847 --> 00:58.930 align:middle line:90%
And they'll give us a
little message saying, whoa,

26
00:58.930 --> 00:59.920 align:middle line:84%
that's a malicious site.

27
00:59.920 --> 01:01.962 align:middle line:90%
And right out of the gate,
we're being protected.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.920 --> 01:01.962 align:middle line:90%
And right out of the gate,
we're being protected.

28
01:01.962 --> 01:04.810 align:middle line:90%
And that part of
Umbrella is free.

29
01:04.810 --> 01:07.960 align:middle line:90%
Now, this used to be a
product called OpenDNS

30
01:07.960 --> 01:11.500 align:middle line:90%
that Cisco purchased that's
now part of Cisco Umbrella.

31
01:11.500 --> 01:13.235 align:middle line:84%
So the basic elements are free.

32
01:13.235 --> 01:14.610 align:middle line:90%
And then as we
continue on, we'll

33
01:14.610 --> 01:16.693 align:middle line:90%
take a look at some advanced
features and policies

34
01:16.693 --> 01:18.970 align:middle line:90%
and options where we can
even lock it down further,

35
01:18.970 --> 01:20.540 align:middle line:90%
and make it more
and more secure.

36
01:20.540 --> 01:21.880 align:middle line:90%
So one of the
challenges here is that

37
01:21.880 --> 01:23.770 align:middle line:90%
in a corporate environment,
it's very unlikely

38
01:23.770 --> 01:25.437 align:middle line:90%
that we're going to
go to every computer

39
01:25.437 --> 01:27.920 align:middle line:90%
and say, hey, please use
this DNS server and so forth.

40
01:27.920 --> 01:29.640 align:middle line:90%
So what's more likely
to happen, if we

41
01:29.640 --> 01:31.432 align:middle line:90%
have a whole bunch of
computers, if they're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.640 --> 01:31.432 align:middle line:90%
have a whole bunch of
computers, if they're

42
01:31.432 --> 01:34.840 align:middle line:90%
DHCP clients, Dynamic Host
Configuration Protocol clients,

43
01:34.840 --> 01:37.360 align:middle line:90%
we'll hand out as an
option a DNS server.

44
01:37.360 --> 01:41.350 align:middle line:90%
And we can point to one or
both of these DNS servers

45
01:41.350 --> 01:43.348 align:middle line:90%
as the DNS servers
these clients use,

46
01:43.348 --> 01:44.890 align:middle line:90%
and then bada bing
bada boom, they're

47
01:44.890 --> 01:47.210 align:middle line:90%
automatically going to start
using those DNS servers.

48
01:47.210 --> 01:49.680 align:middle line:90%
Now, some companies have
their own internal DNS server.

49
01:49.680 --> 01:54.160 align:middle line:90%
So if this is
acme.com, for example,

50
01:54.160 --> 01:57.610 align:middle line:90%
and their local internal DNS
servers are resolving all that,

51
01:57.610 --> 02:00.010 align:middle line:90%
we could integrate
that with open DNS
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:57.610 --> 02:00.010 align:middle line:90%
we could integrate
that with open DNS

52
02:00.010 --> 02:03.250 align:middle line:90%
by using what's called a
virtual appliance that knows

53
02:03.250 --> 02:05.050 align:middle line:84%
what your local domain is.

54
02:05.050 --> 02:06.970 align:middle line:90%
It knows where the
local DNS server is,

55
02:06.970 --> 02:08.740 align:middle line:90%
and then we can train
all the computers

56
02:08.740 --> 02:10.860 align:middle line:90%
to point to this little
virtual appliance.

57
02:10.860 --> 02:12.670 align:middle line:90%
Then when Bob does
a DNS request,

58
02:12.670 --> 02:15.070 align:middle line:90%
if it's for anything
at acme.com,

59
02:15.070 --> 02:17.440 align:middle line:90%
this virtual appliance
from Cisco Umbrella

60
02:17.440 --> 02:19.210 align:middle line:90%
can go ahead and
forward that request

61
02:19.210 --> 02:21.640 align:middle line:90%
to our real internal
DNS server, or if it's

62
02:21.640 --> 02:26.260 align:middle line:90%
for something external,
like www.myfavoritesite.com,

63
02:26.260 --> 02:30.460 align:middle line:90%
the virtual appliance can then
forward that to the DNS servers
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:26.260 --> 02:30.460 align:middle line:90%
the virtual appliance can then
forward that to the DNS servers

64
02:30.460 --> 02:32.427 align:middle line:90%
as part of Cisco
Umbrella who will then

65
02:32.427 --> 02:34.510 align:middle line:90%
make the decision about
the reputation of the site

66
02:34.510 --> 02:37.540 align:middle line:90%
we're trying to go to, and
decide based on policy or not

67
02:37.540 --> 02:39.890 align:middle line:90%
whether or not that's an
acceptable site for Bob to go

68
02:39.890 --> 02:40.390 align:middle line:84%
to.

69
02:40.390 --> 02:43.600 align:middle line:90%
Now, one of the benefits of
buying a license for and adding

70
02:43.600 --> 02:45.790 align:middle line:90%
the additional features
for Cisco Umbrella

71
02:45.790 --> 02:48.610 align:middle line:90%
is that maybe at acme.com
we want to filter

72
02:48.610 --> 02:51.460 align:middle line:84%
17 categories of websites.

73
02:51.460 --> 02:55.270 align:middle line:90%
Maybe no alcohol websites, or
no gaming websites, or no hate

74
02:55.270 --> 02:56.500 align:middle line:84%
websites, or whatever it is.

75
02:56.500 --> 02:59.480 align:middle line:90%
And by having a license for
Cisco Umbrella, when Umbrella

76
02:59.480 --> 03:01.750 align:middle line:90%
sees requests coming
from our organization,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:59.480 --> 03:01.750 align:middle line:90%
sees requests coming
from our organization,

77
03:01.750 --> 03:03.245 align:middle line:84%
it can enforce those policies.

78
03:03.245 --> 03:04.870 align:middle line:90%
And that's just the
tip of the iceberg.

79
03:04.870 --> 03:06.220 align:middle line:90%
We'll continue to take
a look at what else

80
03:06.220 --> 03:07.930 align:middle line:90%
it can do with the
proper license.

81
03:07.930 --> 03:09.573 align:middle line:90%
But that's just
one example is we

82
03:09.573 --> 03:10.990 align:middle line:90%
can have our own
policy about what

83
03:10.990 --> 03:13.570 align:middle line:90%
will be allowed, or
filtered, or denied

84
03:13.570 --> 03:15.950 align:middle line:90%
based on our policy
for our organization.

85
03:15.950 --> 03:17.980 align:middle line:90%
Now, one thing
about Bob is this.

86
03:17.980 --> 03:19.390 align:middle line:84%
This may be a laptop.

87
03:19.390 --> 03:21.340 align:middle line:84%
So maybe Bob's using a laptop.

88
03:21.340 --> 03:23.320 align:middle line:90%
And if his traffic
is being sourced

89
03:23.320 --> 03:26.170 align:middle line:90%
from the internal network at
acme.com, one of the subnets

90
03:26.170 --> 03:28.570 align:middle line:90%
there, it's identified as
coming from our company.

91
03:28.570 --> 03:30.820 align:middle line:90%
But what if Bob takes
his laptop and goes home?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:28.570 --> 03:30.820 align:middle line:90%
But what if Bob takes
his laptop and goes home?

92
03:30.820 --> 03:33.040 align:middle line:90%
So let's say Bob went
home for the night.

93
03:33.040 --> 03:34.750 align:middle line:84%
So now this is Bob's computer.

94
03:34.750 --> 03:37.030 align:middle line:90%
He's connected with
a cable modem or DSL

95
03:37.030 --> 03:38.830 align:middle line:84%
to the internet high speed.

96
03:38.830 --> 03:40.690 align:middle line:90%
Maybe he has a VPN
back to the company,

97
03:40.690 --> 03:42.107 align:middle line:90%
or maybe this is
a company laptop.

98
03:42.107 --> 03:43.815 align:middle line:90%
We just want to make
sure it's protected.

99
03:43.815 --> 03:45.910 align:middle line:90%
And the answer is we can
install a little client.

100
03:45.910 --> 03:47.020 align:middle line:84%
And check out this magic.

101
03:47.020 --> 03:48.430 align:middle line:90%
When Bob with this
client installed,

102
03:48.430 --> 03:49.847 align:middle line:90%
the Umbrella client,
when it makes

103
03:49.847 --> 03:52.720 align:middle line:90%
a request, instead of going
to the service provider DNS

104
03:52.720 --> 03:55.180 align:middle line:90%
server or some other DNS
server he has configured,

105
03:55.180 --> 03:58.840 align:middle line:90%
the client forces that DNS
request up to Cisco Umbrella.

106
03:58.840 --> 04:01.570 align:middle line:90%
And because as part
of the client profile
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
03:58.840 --> 04:01.570 align:middle line:90%
And because as part
of the client profile

107
04:01.570 --> 04:04.330 align:middle line:90%
it's identified that this is
Bob, we can enforce our policy,

108
04:04.330 --> 04:07.180 align:middle line:90%
and also do inspection
for DNS tunneling,

109
04:07.180 --> 04:08.650 align:middle line:84%
or any other DNS mischief.

110
04:08.650 --> 04:11.050 align:middle line:90%
So let's do something fun
before we close this video

111
04:11.050 --> 04:13.750 align:middle line:90%
and let's take a computer
that's not using Umbrella

112
04:13.750 --> 04:15.790 align:middle line:90%
with its default
behavior using a default,

113
04:15.790 --> 04:18.360 align:middle line:90%
like a Google DNS server,
do some actions on it,

114
04:18.360 --> 04:20.110 align:middle line:90%
see what's allowed and
what's not allowed,

115
04:20.110 --> 04:23.080 align:middle line:90%
and then let's just
point without any license

116
04:23.080 --> 04:23.910 align:middle line:84%
for Umbrella yet.

117
04:23.910 --> 04:25.035 align:middle line:84%
This is like the free tier.

118
04:25.035 --> 04:28.360 align:middle line:90%
Let's point that client to use
one of the Umbrella DNS servers

119
04:28.360 --> 04:30.730 align:middle line:90%
and immediately
see the difference.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:28.360 --> 04:30.730 align:middle line:90%
and immediately
see the difference.

120
04:30.730 --> 04:31.550 align:middle line:84%
Let's take a look.

121
04:31.550 --> 04:33.580 align:middle line:90%
So here's the command
prompt on Bob's computer

122
04:33.580 --> 04:36.970 align:middle line:90%
to do an ipconfig
space slash all.

123
04:36.970 --> 04:38.260 align:middle line:84%
That's because I'm old school.

124
04:38.260 --> 04:40.090 align:middle line:90%
That works, or you
could also do this--

125
04:40.090 --> 04:42.700 align:middle line:84%
ipconfig dash all.

126
04:42.700 --> 04:44.260 align:middle line:84%
That also works.

127
04:44.260 --> 04:48.760 align:middle line:90%
In any event, so here's his
IP address, 192.168.1.116.

128
04:48.760 --> 04:50.860 align:middle line:90%
There's his default
gateway, fantastic.

129
04:50.860 --> 04:54.530 align:middle line:90%
And there is a Google DNS server
that we are currently using.

130
04:54.530 --> 04:57.400 align:middle line:90%
So if we open up a browser
and we went to a site

131
04:57.400 --> 05:00.980 align:middle line:90%
like www.google.com,
that would work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:57.400 --> 05:00.980 align:middle line:90%
like www.google.com,
that would work.

132
05:00.980 --> 05:03.590 align:middle line:90%
So just to verify internet
connectivity works.

133
05:03.590 --> 05:08.120 align:middle line:90%
And let's go to
www.CBTNuggets.com.

134
05:08.120 --> 05:09.330 align:middle line:84%
That works.

135
05:09.330 --> 05:11.420 align:middle line:90%
But if we tried to go
to a malicious website--

136
05:11.420 --> 05:13.670 align:middle line:90%
and they've got a really
good test website we can use.

137
05:13.670 --> 05:19.620 align:middle line:90%
It's www.internetbadguys.com
right there.

138
05:19.620 --> 05:21.230 align:middle line:90%
So if we go to
internetbadguys.com,

139
05:21.230 --> 05:24.230 align:middle line:90%
that's an example of a
website that's identified

140
05:24.230 --> 05:27.085 align:middle line:84%
by Umbrella to be malicious.

141
05:27.085 --> 05:29.210 align:middle line:90%
So here it's saying it's
only a demonstration site.

142
05:29.210 --> 05:31.250 align:middle line:90%
And then it says, if
you were using OpenDNS,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:29.210 --> 05:31.250 align:middle line:90%
And then it says, if
you were using OpenDNS,

143
05:31.250 --> 05:33.080 align:middle line:90%
these phishing sites
would be blocked.

144
05:33.080 --> 05:35.090 align:middle line:90%
So it's called OpenDNS
here because that

145
05:35.090 --> 05:38.090 align:middle line:90%
was the original product name
before Cisco acquired them.

146
05:38.090 --> 05:40.310 align:middle line:90%
So let me share with you
on this local machine

147
05:40.310 --> 05:43.850 align:middle line:90%
the difference it makes just
by changing our DNS server

148
05:43.850 --> 05:47.000 align:middle line:90%
to point to the free
tier of Umbrella,

149
05:47.000 --> 05:49.220 align:middle line:84%
or what used to be OpenDNS.

150
05:49.220 --> 05:51.180 align:middle line:90%
So to do that, we'll
go to Control Panel.

151
05:51.180 --> 05:52.670 align:middle line:90%
And click on Network
and Internet,

152
05:52.670 --> 05:55.100 align:middle line:90%
and then click on Network
and Sharing Center.

153
05:55.100 --> 05:56.838 align:middle line:84%
And change adapter settings.

154
05:56.838 --> 05:58.880 align:middle line:90%
And I'm just going to
right-click on my Ethernet0

155
05:58.880 --> 05:59.380 align:middle line:84%
here.

156
05:59.380 --> 06:03.290 align:middle line:90%
Click on Properties, and
go to Properties of IPv4.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
05:59.380 --> 06:03.290 align:middle line:90%
Click on Properties, and
go to Properties of IPv4.

157
06:03.290 --> 06:05.330 align:middle line:90%
And here, instead
of using 8.8.8.8,

158
06:05.330 --> 06:07.250 align:middle line:90%
let's use one of
the two DNS servers

159
06:07.250 --> 06:09.020 align:middle line:84%
that are part of Umbrella.

160
06:09.020 --> 06:16.388 align:middle line:90%
So that 208.67.222.222, and
the other one's 208.67.220.220.

161
06:16.388 --> 06:17.930 align:middle line:90%
One's going to be
good enough for us.

162
06:17.930 --> 06:19.320 align:middle line:84%
Here we'll click on OK.

163
06:19.320 --> 06:20.340 align:middle line:84%
Click on Close.

164
06:20.340 --> 06:22.010 align:middle line:90%
Then go back to
the command prompt.

165
06:22.010 --> 06:22.820 align:middle line:84%
Do an up arrow key.

166
06:22.820 --> 06:23.780 align:middle line:84%
Make sure it took.

167
06:23.780 --> 06:26.303 align:middle line:90%
And sure enough, there's
our new DNS server.

168
06:26.303 --> 06:28.220 align:middle line:90%
So now if we try to go
to that website again--

169
06:28.220 --> 06:29.500 align:middle line:84%
I'll click on Refresh here--

170
06:29.500 --> 06:31.250 align:middle line:90%
now it's showing us
Cisco Umbrella saying,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
06:29.500 --> 06:31.250 align:middle line:90%
now it's showing us
Cisco Umbrella saying,

171
06:31.250 --> 06:33.320 align:middle line:90%
"This site is blocked due
to a security threat."

172
06:33.320 --> 06:36.670 align:middle line:90%
And if we went to
welcome.umbrella.com right

173
06:36.670 --> 06:38.420 align:middle line:90%
here, that green
background with the check

174
06:38.420 --> 06:40.580 align:middle line:90%
indicates that we are
using Cisco Umbrella.

175
06:40.580 --> 06:42.920 align:middle line:90%
If we'd gone to
welcome.umbrella.com

176
06:42.920 --> 06:45.960 align:middle line:90%
and we weren't pointing to
the Umbrella DNS servers,

177
06:45.960 --> 06:48.140 align:middle line:90%
It would say, oh, you
could be protected right

178
06:48.140 --> 06:49.770 align:middle line:84%
now if you were using umbrella.

179
06:49.770 --> 06:51.437 align:middle line:90%
And if you scroll
down, it has an option

180
06:51.437 --> 06:53.990 align:middle line:90%
for setting up a free
trial of the Cisco Umbrella

181
06:53.990 --> 06:56.420 align:middle line:90%
full product, which has some
of additional features, which

182
06:56.420 --> 06:58.878 align:middle line:90%
we will be talking about as we
proceed through these videos

183
06:58.878 --> 06:59.430 align:middle line:84%
together.

184
06:59.430 --> 07:01.847 align:middle line:90%
So in this video, we've taken
a look at three basic ideas.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
06:59.430 --> 07:01.847 align:middle line:90%
So in this video, we've taken
a look at three basic ideas.

185
07:01.847 --> 07:04.400 align:middle line:90%
Number one, just by
pointing to the DNS servers

186
07:04.400 --> 07:07.310 align:middle line:90%
on the free tier with Cisco
Umbrella, we're more secure.

187
07:07.310 --> 07:09.230 align:middle line:90%
Number two, if we
have a license,

188
07:09.230 --> 07:11.030 align:middle line:90%
we can not only point
to the DNS servers,

189
07:11.030 --> 07:13.370 align:middle line:90%
but we can also
have policies based

190
07:13.370 --> 07:15.590 align:middle line:90%
on where we're coming
from that can be enforced,

191
07:15.590 --> 07:16.580 align:middle line:84%
like categories.

192
07:16.580 --> 07:18.110 align:middle line:90%
And the third
thing we identified

193
07:18.110 --> 07:20.060 align:middle line:90%
is that we can
verify whether or not

194
07:20.060 --> 07:22.400 align:middle line:90%
we're using Cisco
Umbrella at any level

195
07:22.400 --> 07:25.190 align:middle line:90%
simply by going to
welcome.opendns.com

196
07:25.190 --> 07:26.960 align:middle line:84%
or welcome.umbrella.com.

197
07:26.960 --> 07:28.730 align:middle line:90%
And the feedback
on that web page

198
07:28.730 --> 07:31.100 align:middle line:90%
will show us whether
or not we are currently
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

198
07:28.730 --> 07:31.100 align:middle line:90%
will show us whether
or not we are currently

199
07:31.100 --> 07:33.148 align:middle line:84%
using Umbrella DNS services.

200
07:33.148 --> 07:34.940 align:middle line:90%
So that's a lot of fun,
but check this out.

201
07:34.940 --> 07:35.780 align:middle line:84%
It gets even better.

202
07:35.780 --> 07:37.363 align:middle line:90%
If we have a paid
version of Umbrella,

203
07:37.363 --> 07:38.990 align:middle line:90%
as we'll walk through
in the next video

204
07:38.990 --> 07:42.140 align:middle line:90%
and start talking about, we can
start implementing the policies

205
07:42.140 --> 07:44.285 align:middle line:90%
that we want to enforce
based on customers

206
07:44.285 --> 07:46.910 align:middle line:90%
who are at our local network who
are going out to the internet,

207
07:46.910 --> 07:48.910 align:middle line:90%
or whether they're home
with the roaming client,

208
07:48.910 --> 07:50.840 align:middle line:90%
and how we can enforce
the policy that we want

209
07:50.840 --> 07:53.450 align:middle line:90%
to keep all those devices
safe, regardless of where

210
07:53.450 --> 07:54.450 align:middle line:84%
they're connecting from.

211
07:54.450 --> 07:56.593 align:middle line:90%
So we'll continue that
story in the next video.

212
07:56.593 --> 07:58.760 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

213
07:58.760 --> 08:02.140 align:middle line:90%
And I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

213
07:58.760 --> 08:02.140 align:middle line:90%
And I'd like to thank
you for viewing.