WEBVTT

1
00:00.000 --> 00:00.580 align:middle line:84%


2
00:00.580 --> 00:04.030 align:middle line:90%
The single act of just pointing
and using the DNS servers

3
00:04.030 --> 00:05.770 align:middle line:90%
in the Umbrella
cloud is going to be

4
00:05.770 --> 00:09.000 align:middle line:90%
a huge benefit for most systems
and most computers on networks

5
00:09.000 --> 00:09.500 align:middle line:84%
today.

6
00:09.500 --> 00:11.080 align:middle line:90%
Now, if we want to
kick it up a notch

7
00:11.080 --> 00:13.030 align:middle line:90%
and have a licensed
version of Umbrella,

8
00:13.030 --> 00:16.180 align:middle line:90%
we can start setting up
policies to do further control.

9
00:16.180 --> 00:18.610 align:middle line:90%
In this video, I'd like
to give you a big picture

10
00:18.610 --> 00:20.650 align:middle line:90%
view of what some
of those options are

11
00:20.650 --> 00:21.970 align:middle line:84%
and where we can set those.

12
00:21.970 --> 00:23.890 align:middle line:90%
And then we'll follow
it up with an example

13
00:23.890 --> 00:27.880 align:middle line:90%
of creating a policy, and then
subsequently testing it out

14
00:27.880 --> 00:29.805 align:middle line:84%
to verify that it works.

15
00:29.805 --> 00:31.180 align:middle line:90%
So let's take a
look at what goes
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.805 --> 00:31.180 align:middle line:90%
So let's take a
look at what goes

16
00:31.180 --> 00:34.960 align:middle line:90%
into this thing called a policy
as part of Cisco Umbrella.

17
00:34.960 --> 00:36.700 align:middle line:90%
And the policy that
we're going to set up

18
00:36.700 --> 00:38.440 align:middle line:84%
is sort of like a shopping cart.

19
00:38.440 --> 00:40.340 align:middle line:84%
Let's put a cart there.

20
00:40.340 --> 00:42.490 align:middle line:90%
So if we go shopping and
we have a shopping cart,

21
00:42.490 --> 00:44.440 align:middle line:90%
we're putting a lot of
individual components

22
00:44.440 --> 00:45.590 align:middle line:84%
into that shopping cart.

23
00:45.590 --> 00:48.340 align:middle line:90%
Then we checkout, and basically
we purchase those items.

24
00:48.340 --> 00:49.430 align:middle line:84%
And we leave with them.

25
00:49.430 --> 00:51.860 align:middle line:90%
Well, a Cisco Umbrella policy
is a lot like that, too.

26
00:51.860 --> 00:53.710 align:middle line:90%
We have a policy
that's going to include

27
00:53.710 --> 00:57.287 align:middle line:90%
several specific details
that all go into a policy,

28
00:57.287 --> 00:59.620 align:middle line:90%
and then with that policy is
all the individual details.

29
00:59.620 --> 01:01.852 align:middle line:90%
We can then apply that
and have it enforced.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:59.620 --> 01:01.852 align:middle line:90%
We can then apply that
and have it enforced.

30
01:01.852 --> 01:04.060 align:middle line:90%
So let's have a chat about
a few of the elements that

31
01:04.060 --> 01:04.940 align:middle line:84%
are in a policy.

32
01:04.940 --> 01:07.510 align:middle line:90%
One of the components
is destinations.

33
01:07.510 --> 01:11.650 align:middle line:90%
So if you have specific
destinations based on URL or IP

34
01:11.650 --> 01:15.190 align:middle line:90%
address that you want to
always permit or always deny,

35
01:15.190 --> 01:18.190 align:middle line:90%
you can simply add those to
the Destinations category

36
01:18.190 --> 01:20.980 align:middle line:90%
of a policy, and that would
then allow that traffic

37
01:20.980 --> 01:23.680 align:middle line:90%
or deny that traffic based
on those destinations.

38
01:23.680 --> 01:26.410 align:middle line:90%
Another section is
content categories.

39
01:26.410 --> 01:28.410 align:middle line:90%
So at our organization
if we had policies,

40
01:28.410 --> 01:31.180 align:middle line:90%
say we want to stop users
like Bob and everybody else
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:28.410 --> 01:31.180 align:middle line:90%
say we want to stop users
like Bob and everybody else

41
01:31.180 --> 01:33.220 align:middle line:90%
from going to certain
categories of websites,

42
01:33.220 --> 01:36.490 align:middle line:90%
like alcohol-related
websites, hate

43
01:36.490 --> 01:40.090 align:middle line:90%
websites, or gaming websites,
or social media, whatever

44
01:40.090 --> 01:43.420 align:middle line:90%
the policy is, we can
identify those categories,

45
01:43.420 --> 01:46.990 align:middle line:90%
and then when the requests
make it up to the Umbrella DNS

46
01:46.990 --> 01:49.870 align:middle line:90%
servers, based on our
policy, they can either say,

47
01:49.870 --> 01:51.910 align:middle line:90%
yep, here's the IP
address you asked for.

48
01:51.910 --> 01:52.570 align:middle line:84%
Go ahead.

49
01:52.570 --> 01:55.107 align:middle line:90%
Or they can redirect that
client to a web page that says,

50
01:55.107 --> 01:55.690 align:middle line:84%
you know what?

51
01:55.690 --> 01:57.490 align:middle line:90%
This has been blocked
by your policy.

52
01:57.490 --> 02:01.010 align:middle line:90%
Another section of a
policy is the applications.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:57.490 --> 02:01.010 align:middle line:90%
Another section of a
policy is the applications.

53
02:01.010 --> 02:05.920 align:middle line:90%
So an application would be like
Google Maps, or Google Drive,

54
02:05.920 --> 02:09.820 align:middle line:90%
or Facebook Messenger, or some
other internet-related app

55
02:09.820 --> 02:12.730 align:middle line:90%
so that when Bob the
user tries to go there,

56
02:12.730 --> 02:14.800 align:middle line:90%
the DNS server
can identify that,

57
02:14.800 --> 02:16.750 align:middle line:90%
and say, ooh, I see
you're trying to go here.

58
02:16.750 --> 02:18.220 align:middle line:90%
And I'm going to go
ahead and stop it.

59
02:18.220 --> 02:19.595 align:middle line:90%
And based on the
license, there's

60
02:19.595 --> 02:21.310 align:middle line:90%
some additional options
in Cisco Umbrella

61
02:21.310 --> 02:24.280 align:middle line:84%
which can use TLS decryption.

62
02:24.280 --> 02:25.780 align:middle line:90%
And that would come
into play if Bob

63
02:25.780 --> 02:27.130 align:middle line:84%
is trying to go to a website.

64
02:27.130 --> 02:31.330 align:middle line:90%
And let's imagine that the Talos
in the cloud as part of Cisco
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:27.130 --> 02:31.330 align:middle line:90%
And let's imagine that the Talos
in the cloud as part of Cisco

65
02:31.330 --> 02:34.010 align:middle line:90%
Umbrella hasn't quite
identified that server,

66
02:34.010 --> 02:34.990 align:middle line:84%
or they're not sure.

67
02:34.990 --> 02:36.670 align:middle line:90%
They can actually
have Bob's traffic

68
02:36.670 --> 02:39.070 align:middle line:90%
redirected up to their
servers up in the cloud.

69
02:39.070 --> 02:41.080 align:middle line:90%
They can then do TLS
decryption so they

70
02:41.080 --> 02:42.773 align:middle line:90%
can see what the
real request is,

71
02:42.773 --> 02:45.190 align:middle line:90%
and then say, ooh, that's what
you're really trying to do.

72
02:45.190 --> 02:46.700 align:middle line:84%
We're going to block it.

73
02:46.700 --> 02:48.940 align:middle line:90%
So the TLS decryption
is an option

74
02:48.940 --> 02:52.240 align:middle line:90%
that is very handy if the Talos
cloud and the Cisco Umbrella

75
02:52.240 --> 02:53.900 align:middle line:90%
isn't sure about a
category, or really

76
02:53.900 --> 02:55.150 align:middle line:84%
wants to see what's happening.

77
02:55.150 --> 02:57.227 align:middle line:90%
Using TLS decryption,
it has a chance

78
02:57.227 --> 02:58.810 align:middle line:90%
to then analyze that
traffic, and then

79
02:58.810 --> 03:01.240 align:middle line:90%
make a decision on whether it
should allow it or drop it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:58.810 --> 03:01.240 align:middle line:90%
make a decision on whether it
should allow it or drop it.

80
03:01.240 --> 03:02.907 align:middle line:90%
There's also a security
setting section,

81
03:02.907 --> 03:05.320 align:middle line:90%
which has some defaults
such as like malware sites,

82
03:05.320 --> 03:08.920 align:middle line:90%
if Talos in the cloud knows
that the site that Bob is trying

83
03:08.920 --> 03:12.550 align:middle line:90%
to go to has a reputation
for having a lot of malware,

84
03:12.550 --> 03:14.470 align:middle line:90%
the default for that
in the security policy

85
03:14.470 --> 03:15.520 align:middle line:84%
is going to say, no.

86
03:15.520 --> 03:16.690 align:middle line:84%
Just say no.

87
03:16.690 --> 03:17.200 align:middle line:84%
Block that.

88
03:17.200 --> 03:18.552 align:middle line:84%
Don't allow that to happen.

89
03:18.552 --> 03:20.260 align:middle line:90%
But we can override
that, and we can also

90
03:20.260 --> 03:22.930 align:middle line:90%
make it more stringent, based on
the properties of the security

91
03:22.930 --> 03:23.620 align:middle line:84%
settings.

92
03:23.620 --> 03:26.740 align:middle line:90%
There's also the feedback that
we're going to give to Bob.

93
03:26.740 --> 03:29.180 align:middle line:90%
And that's referred
to as the Block page,

94
03:29.180 --> 03:31.060 align:middle line:90%
so that when Bob
does go out to a site
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:29.180 --> 03:31.060 align:middle line:90%
so that when Bob
does go out to a site

95
03:31.060 --> 03:33.820 align:middle line:90%
or attempts to go out to a
site and it's being blocked,

96
03:33.820 --> 03:36.820 align:middle line:90%
there can be a web page
from a server as part

97
03:36.820 --> 03:39.130 align:middle line:90%
of Cisco Umbrella that's
coming back with a message.

98
03:39.130 --> 03:41.740 align:middle line:90%
And we can customize what
that Block page looks like,

99
03:41.740 --> 03:44.710 align:middle line:90%
and what options exist there,
including, for example,

100
03:44.710 --> 03:48.610 align:middle line:90%
an email address for Bob
to request access to a site

101
03:48.610 --> 03:50.560 align:middle line:90%
or to a category
so he's just not

102
03:50.560 --> 03:52.270 align:middle line:84%
left hanging with a blank page.

103
03:52.270 --> 03:54.040 align:middle line:90%
He's actually got
a feedback page

104
03:54.040 --> 03:55.618 align:middle line:84%
that indicates what's going on.

105
03:55.618 --> 03:57.160 align:middle line:90%
There's also some
integration as part

106
03:57.160 --> 04:00.230 align:middle line:90%
of our policies with third-party
software and features,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

106
03:57.160 --> 04:00.230 align:middle line:90%
of our policies with third-party
software and features,

107
04:00.230 --> 04:02.230 align:middle line:90%
which we'll take a look
at in the interface here

108
04:02.230 --> 04:03.350 align:middle line:84%
in the next video.

109
04:03.350 --> 04:05.990 align:middle line:90%
And then once we have
a policy created,

110
04:05.990 --> 04:08.200 align:middle line:90%
we could apply that
to all traffic coming

111
04:08.200 --> 04:10.450 align:middle line:90%
from this network,
or we could apply it

112
04:10.450 --> 04:12.310 align:middle line:90%
to all traffic
coming from Bob if he

113
04:12.310 --> 04:15.100 align:middle line:90%
has the remote client
installed on him for OpenDNS,

114
04:15.100 --> 04:16.360 align:middle line:84%
or for Cisco Umbrella, rather.

115
04:16.360 --> 04:18.490 align:middle line:90%
And that way, no matter
where Bob is coming from,

116
04:18.490 --> 04:20.890 align:middle line:90%
whether it's the corporate
network, or if he's roaming,

117
04:20.890 --> 04:22.630 align:middle line:90%
when those requests,
those DNS requests

118
04:22.630 --> 04:24.460 align:middle line:90%
are sent up to Cisco
Umbrella's servers,

119
04:24.460 --> 04:26.980 align:middle line:90%
then the Umbrella servers,
based on the policy for Bob

120
04:26.980 --> 04:29.590 align:middle line:90%
that's been assigned to him,
can respond back appropriately.

121
04:29.590 --> 04:33.010 align:middle line:90%
So in our policy for blocking
alcohol-related sites
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:29.590 --> 04:33.010 align:middle line:90%
So in our policy for blocking
alcohol-related sites

122
04:33.010 --> 04:35.438 align:middle line:90%
we can have a Block page
coming back saying, hey,

123
04:35.438 --> 04:36.730 align:middle line:84%
you're not allowed to go there.

124
04:36.730 --> 04:40.250 align:middle line:90%
And that's because of the policy
blocking alcohol-related sites.

125
04:40.250 --> 04:42.520 align:middle line:90%
So that's the big picture
view of how policies

126
04:42.520 --> 04:43.690 align:middle line:84%
work with Cisco Umbrella.

127
04:43.690 --> 04:45.672 align:middle line:90%
We identify each of the
individual components

128
04:45.672 --> 04:47.380 align:middle line:90%
about what we want to
allow or not allow,

129
04:47.380 --> 04:50.440 align:middle line:90%
such as certain applications, or
certain categories of websites

130
04:50.440 --> 04:51.380 align:middle line:84%
and so forth.

131
04:51.380 --> 04:53.930 align:middle line:90%
And then we bundle those, or
include those in a policy.

132
04:53.930 --> 04:55.930 align:middle line:90%
And then we specify who
we want that to apply to

133
04:55.930 --> 04:56.770 align:middle line:84%
in our organization.

134
04:56.770 --> 04:59.410 align:middle line:90%
Is it people who are just coming
from the corporate headquarter

135
04:59.410 --> 04:59.910 align:middle line:84%
site?

136
04:59.910 --> 05:01.290 align:middle line:90%
Or is it for our
roaming clients?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
04:59.910 --> 05:01.290 align:middle line:90%
Or is it for our
roaming clients?

137
05:01.290 --> 05:02.470 align:middle line:84%
Is it for everybody?

138
05:02.470 --> 05:04.950 align:middle line:90%
So we have some flexibility
about which policies

139
05:04.950 --> 05:06.880 align:middle line:84%
we apply to which devices.

140
05:06.880 --> 05:09.380 align:middle line:90%
So we'll get right into the
policy in the very next video.

141
05:09.380 --> 05:11.172 align:middle line:90%
So I look forward to
seeing you, my friend,

142
05:11.172 --> 05:12.460 align:middle line:84%
there in just a moment.

143
05:12.460 --> 05:14.940 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

144
05:14.940 --> 05:18.290 align:middle line:90%
And I'd like to thank
you for viewing.